From 3ac9b1121e28d8152ca6376cf7c79fb90a6fa619 Mon Sep 17 00:00:00 2001 From: Anand Krishnamoorthi <35780660+anakrish@users.noreply.github.com> Date: Thu, 23 May 2024 11:30:41 -0400 Subject: [PATCH] Lockdown kata test prints as well as prints of various values (#249) Signed-off-by: Anand Krishnamoorthi --- src/tests/interpreter/mod.rs | 20 +- .../cases/builtins/debugging/print.yaml | 84 + tests/kata/data/k8s-policy-job/prints.json | 1055 +++ tests/kata/data/k8s-policy-pod/prints.json | 999 ++ tests/kata/data/k8s-policy-rc/prints.json | 1000 ++ tests/kata/data/pod-cm1/prints.json | 1216 +++ tests/kata/data/pod-cm2/prints.json | 2400 +++++ tests/kata/data/pod-exec/prints.json | 1910 ++++ tests/kata/data/pod-lifecycle/prints.json | 1582 ++++ tests/kata/data/pod-many-layers/prints.json | 8087 +++++++++++++++++ .../data/pod-persistent-volumes/prints.json | 1509 +++ .../kata/data/pod-same-containers/prints.json | 3506 +++++++ tests/kata/data/web/prints.json | 1631 ++++ tests/kata/data/web2/prints.json | 1621 ++++ tests/kata/main.rs | 20 + 15 files changed, 26637 insertions(+), 3 deletions(-) create mode 100644 tests/interpreter/cases/builtins/debugging/print.yaml create mode 100644 tests/kata/data/k8s-policy-job/prints.json create mode 100644 tests/kata/data/k8s-policy-pod/prints.json create mode 100644 tests/kata/data/k8s-policy-rc/prints.json create mode 100644 tests/kata/data/pod-cm1/prints.json create mode 100644 tests/kata/data/pod-cm2/prints.json create mode 100644 tests/kata/data/pod-exec/prints.json create mode 100644 tests/kata/data/pod-lifecycle/prints.json create mode 100644 tests/kata/data/pod-many-layers/prints.json create mode 100644 tests/kata/data/pod-persistent-volumes/prints.json create mode 100644 tests/kata/data/pod-same-containers/prints.json create mode 100644 tests/kata/data/web/prints.json create mode 100644 tests/kata/data/web2/prints.json diff --git a/src/tests/interpreter/mod.rs b/src/tests/interpreter/mod.rs index 0613f41..f986995 100644 --- a/src/tests/interpreter/mod.rs +++ b/src/tests/interpreter/mod.rs @@ -139,9 +139,10 @@ pub fn eval_file( query: &str, enable_tracing: bool, strict: bool, -) -> Result> { +) -> Result<(Vec, Vec)> { let mut engine: Engine = Engine::new(); engine.set_strict_builtin_errors(strict); + engine.set_gather_prints(true); #[cfg(feature = "coverage")] engine.set_enable_coverage(true); @@ -206,7 +207,7 @@ pub fn eval_file( } } - Ok(results) + Ok((results, engine.take_prints()?)) } #[derive(PartialEq, Debug)] @@ -254,6 +255,7 @@ struct TestCase { query: String, sort_bindings: Option, want_result: Option, + want_prints: Option>, no_result: Option, skip: Option, error: Option, @@ -333,7 +335,7 @@ fn yaml_test_impl(file: &str) -> Result<()> { enable_tracing, case.strict, ) { - Ok(results) => match case.want_result { + Ok((results, prints)) => match case.want_result { Some(want_result) => { let mut expected_results = vec![]; match want_result { @@ -344,6 +346,18 @@ fn yaml_test_impl(file: &str) -> Result<()> { } check_output(&results, &expected_results)?; + if let Some(expected_prints) = case.want_prints { + assert_eq!(expected_prints.len(), prints.len()); + for (idx, ep) in expected_prints.into_iter().enumerate() { + if ep != prints[idx] { + std::println!( + "print mismatch :\n{}", + prettydiff::diff_chars(&ep, &prints[idx]) + ); + panic!("exiting"); + } + } + } } _ if case.no_result == Some(true) => (), _ => bail!("eval succeeded and did not produce any errors"), diff --git a/tests/interpreter/cases/builtins/debugging/print.yaml b/tests/interpreter/cases/builtins/debugging/print.yaml new file mode 100644 index 0000000..4a0a8a4 --- /dev/null +++ b/tests/interpreter/cases/builtins/debugging/print.yaml @@ -0,0 +1,84 @@ +# Copyright (c) Microsoft Corporation. +# Licensed under the MIT License. + +cases: + - note: all + data: {} + modules: + - | + package test + import rego.v1 + + x if { + every obj in objs { + print(obj) + } + + # Print twice + [ 1 | [1, 2][_]; print(y) ] + + # The following is printed only once due to early return, eventhough there is a loop. + [1,2,3,4,5,6][_] + + # Print multiple items + # Note that if string is contained within another value, then quotes will be + # printed around the string. + print("Hello", ["Hello"], [{1:2}, {1,2}]) + + print("done") + } + + y if not z + z := true + + objs = [ + null, + true, + false, + 1, + 0, + -0, + -1, + 1.1, + 0.1, + -1.1, + "Hello", + "hello\nworld", + `hello + world`, + [1,2,3], + {1,2,3}, + {"hello":"world", + "வணக்கம்" : "ശുഭദിനം"}, + set(), + {} + ] + + query: data.test.x + want_result: true + want_prints: + - "rego_0:6: null" + - "rego_0:6: true" + - "rego_0:6: false" + - "rego_0:6: 1" + - "rego_0:6: 0" + - "rego_0:6: 0" + - "rego_0:6: -1" + - "rego_0:6: 1.1" + - "rego_0:6: 0.1" + - "rego_0:6: -1.1" + - "rego_0:6: Hello" + - "rego_0:6: hello\nworld" + - "rego_0:6: hello\n world" + - "rego_0:6: [1, 2, 3]" + - "rego_0:6: {1, 2, 3}" + - "rego_0:6: {\"hello\": \"world\", \"வணக்கம்\": \"ശുഭദിനം\"}" + - "rego_0:6: {}" + - "rego_0:6: {}" + - "rego_0:10: " + - "rego_0:10: " + - "rego_0:18: Hello [\"Hello\"] [{1: 2}, {1, 2}]" + - "rego_0:20: done" + + + diff --git a/tests/kata/data/k8s-policy-job/prints.json b/tests/kata/data/k8s-policy-job/prints.json new file mode 100644 index 0000000..36de33d --- /dev/null +++ b/tests/kata/data/k8s-policy-job/prints.json @@ -0,0 +1,1055 @@ +[ + [], + [], + [], + [ + "tests/kata/data/k8s-policy-job/policy.rego:1046: CreateSandboxRequest: i_pidns = false" + ], + [], + [ + "tests/kata/data/k8s-policy-job/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-job/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-job/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-job/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/k8s-policy-job/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/k8s-policy-job/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-job-dx6cb_392939d5-72a0-4421-9cd7-1e89c3f86256\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-job-dx6cb\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"392939d5-72a0-4421-9cd7-1e89c3f86256\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-92275a86-e0ea-c2c4-9e0c-4ac1ebe428eb\"}", + "tests/kata/data/k8s-policy-job/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:130: allow_by_anno 1: i_s_name = policy-job-dx6cb", + "tests/kata/data/k8s-policy-job/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-job/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-job/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/k8s-policy-job/policy.rego:205: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/k8s-policy-job/policy.rego:209: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/k8s-policy-job/policy.rego:236: allow_sandbox_container_name: start", + "tests/kata/data/k8s-policy-job/policy.rego:252: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-job/policy.rego:257: container_annotation_missing: true", + "tests/kata/data/k8s-policy-job/policy.rego:240: allow_sandbox_container_name: true", + "tests/kata/data/k8s-policy-job/policy.rego:274: allow_sandbox_net_namespace: start", + "tests/kata/data/k8s-policy-job/policy.rego:280: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-92275a86-e0ea-c2c4-9e0c-4ac1ebe428eb", + "tests/kata/data/k8s-policy-job/policy.rego:284: allow_sandbox_net_namespace: true", + "tests/kata/data/k8s-policy-job/policy.rego:300: allow_sandbox_log_directory: start", + "tests/kata/data/k8s-policy-job/policy.rego:307: allow_sandbox_log_directory: regex2 = ^/var/log/pods/kata-containers-k8s-tests_policy-job-dx6cb_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/k8s-policy-job/policy.rego:310: allow_sandbox_log_directory: i_dir = /var/log/pods/kata-containers-k8s-tests_policy-job-dx6cb_392939d5-72a0-4421-9cd7-1e89c3f86256", + "tests/kata/data/k8s-policy-job/policy.rego:314: allow_sandbox_log_directory: true", + "tests/kata/data/k8s-policy-job/policy.rego:216: allow_by_container_type 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:220: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/k8s-policy-job/policy.rego:201: allow_by_container_types: true", + "tests/kata/data/k8s-policy-job/policy.rego:430: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/k8s-policy-job/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4 regex = ^[a-z0-9]{64}$", + "tests/kata/data/k8s-policy-job/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-job/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-job/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4/rootfs", + "tests/kata/data/k8s-policy-job/policy.rego:711: allow_root_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = proc", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = proc", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4-c45e5b9869248a78-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:452: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/k8s-policy-job/policy.rego:459: allow_process: i terminal = false p terminal = false", + "tests/kata/data/k8s-policy-job/policy.rego:462: allow_process: i cwd = / i cwd = /", + "tests/kata/data/k8s-policy-job/policy.rego:465: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/k8s-policy-job/policy.rego:982: allow_caps: policy Ambient = []", + "tests/kata/data/k8s-policy-job/policy.rego:983: allow_caps: input Ambient = []", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-job/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-job/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:994: allow_caps: policy Inheritable = []", + "tests/kata/data/k8s-policy-job/policy.rego:995: allow_caps: input Inheritable = []", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-job/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:497: allow_args 1: no args", + "tests/kata/data/k8s-policy-job/policy.rego:505: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/k8s-policy-job/policy.rego:506: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/k8s-policy-job/policy.rego:518: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-job/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:527: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-job/policy.rego:536: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-job/policy.rego:540: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/k8s-policy-job/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:514: allow_args 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/k8s-policy-job/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:556: allow_env: true", + "tests/kata/data/k8s-policy-job/policy.rego:473: allow_process: true", + "tests/kata/data/k8s-policy-job/policy.rego:165: allow_by_sandbox_name: true", + "tests/kata/data/k8s-policy-job/policy.rego:134: allow_by_anno 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-job/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-job/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/k8s-policy-job/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/sys/devices/virtual/powercap\", \"/proc/scsi\"]", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:352: allow_masked_paths 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:355: allow_masked_paths 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-job/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-job/policy.rego:389: allow_readonly_paths 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:392: allow_readonly_paths 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:340: allow_linux: true", + "tests/kata/data/k8s-policy-job/policy.rego:79: CreateContainerRequest: true", + "tests/kata/data/k8s-policy-job/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-job/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-job/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-job/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/k8s-policy-job/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"hello\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}", + "tests/kata/data/k8s-policy-job/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-job-dx6cb_392939d5-72a0-4421-9cd7-1e89c3f86256\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-job-dx6cb\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"392939d5-72a0-4421-9cd7-1e89c3f86256\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-92275a86-e0ea-c2c4-9e0c-4ac1ebe428eb\"}", + "tests/kata/data/k8s-policy-job/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace" + ], + [], + [], + [], + [], + [], + [ + "tests/kata/data/k8s-policy-job/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-job/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-job/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-job/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/k8s-policy-job/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/k8s-policy-job/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"hello\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4\", \"io.kubernetes.cri.sandbox-name\": \"policy-job-dx6cb\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"392939d5-72a0-4421-9cd7-1e89c3f86256\"}", + "tests/kata/data/k8s-policy-job/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:130: allow_by_anno 1: i_s_name = policy-job-dx6cb", + "tests/kata/data/k8s-policy-job/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-job/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-job/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = container", + "tests/kata/data/k8s-policy-job/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-job/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-job/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-job/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/k8s-policy-job/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"hello\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}", + "tests/kata/data/k8s-policy-job/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"hello\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4\", \"io.kubernetes.cri.sandbox-name\": \"policy-job-dx6cb\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"392939d5-72a0-4421-9cd7-1e89c3f86256\"}", + "tests/kata/data/k8s-policy-job/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-job/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-job/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:130: allow_by_anno 1: i_s_name = policy-job-dx6cb", + "tests/kata/data/k8s-policy-job/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-job/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-job/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-job/policy.rego:196: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/k8s-policy-job/policy.rego:205: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/k8s-policy-job/policy.rego:220: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/k8s-policy-job/policy.rego:224: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/k8s-policy-job/policy.rego:244: allow_container_name: start", + "tests/kata/data/k8s-policy-job/policy.rego:261: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-job/policy.rego:265: allow_container_annotation: p_value = hello i_value = hello", + "tests/kata/data/k8s-policy-job/policy.rego:269: allow_container_annotation: true", + "tests/kata/data/k8s-policy-job/policy.rego:248: allow_container_name: true", + "tests/kata/data/k8s-policy-job/policy.rego:288: allow_net_namespace: start", + "tests/kata/data/k8s-policy-job/policy.rego:295: allow_net_namespace: true", + "tests/kata/data/k8s-policy-job/policy.rego:318: allow_log_directory: start", + "tests/kata/data/k8s-policy-job/policy.rego:325: allow_log_directory: true", + "tests/kata/data/k8s-policy-job/policy.rego:231: allow_by_container_type 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:201: allow_by_container_types: true", + "tests/kata/data/k8s-policy-job/policy.rego:430: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/k8s-policy-job/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = d2bc5590b33176f997388b25f600080d2276cbd08ad134ace2d254260ac864e4 regex = ^[a-z0-9]{64}$", + "tests/kata/data/k8s-policy-job/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-job/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-job/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa/rootfs", + "tests/kata/data/k8s-policy-job/policy.rego:711: allow_root_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = proc", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = proc", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-4195c832f3a3ed66-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-[a-z0-9]{16}-hosts$", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-0f5544bf9955d14d-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-[a-z0-9]{16}-termination-log$", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-2f1945da6e7bade6-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-[a-z0-9]{16}-hostname$", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-22d6d391f26cb161-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-job/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-aa0738a33eb59dbf-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/92fe9b0523a4ef0e39cdd2a509bd6a13639571f50d9d7df74f6dbab37cae23fa-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/k8s-policy-job/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/k8s-policy-job/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-job/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-job/policy.rego:452: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/k8s-policy-job/policy.rego:459: allow_process: i terminal = false p terminal = false", + "tests/kata/data/k8s-policy-job/policy.rego:462: allow_process: i cwd = / i cwd = /", + "tests/kata/data/k8s-policy-job/policy.rego:465: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/k8s-policy-job/policy.rego:982: allow_caps: policy Ambient = []", + "tests/kata/data/k8s-policy-job/policy.rego:983: allow_caps: input Ambient = []", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-job/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-job/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:994: allow_caps: policy Inheritable = []", + "tests/kata/data/k8s-policy-job/policy.rego:995: allow_caps: input Inheritable = []", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-job/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-job/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-job/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-job/policy.rego:497: allow_args 1: no args", + "tests/kata/data/k8s-policy-job/policy.rego:505: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"sleep 120\"]", + "tests/kata/data/k8s-policy-job/policy.rego:506: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"sleep 120\"]", + "tests/kata/data/k8s-policy-job/policy.rego:518: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/k8s-policy-job/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:527: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/k8s-policy-job/policy.rego:536: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/k8s-policy-job/policy.rego:540: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/k8s-policy-job/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:518: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/k8s-policy-job/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:527: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/k8s-policy-job/policy.rego:536: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/k8s-policy-job/policy.rego:540: allow_arg 3: p_arg3 = -c", + "tests/kata/data/k8s-policy-job/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:518: allow_arg 1: i = 2 i_arg = sleep 120 p_arg = sleep 120", + "tests/kata/data/k8s-policy-job/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:527: allow_arg 2: i = 2 i_arg = sleep 120 p_arg = sleep 120", + "tests/kata/data/k8s-policy-job/policy.rego:536: allow_arg 3: i = 2 i_arg = sleep 120 p_arg = sleep 120", + "tests/kata/data/k8s-policy-job/policy.rego:540: allow_arg 3: p_arg3 = sleep 120", + "tests/kata/data/k8s-policy-job/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:514: allow_args 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"var1=val1\"]", + "tests/kata/data/k8s-policy-job/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=policy-job-dx6cb\", \"var1=val1\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\"]", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = HOSTNAME=policy-job-dx6cb", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:619: allow_var 5: true", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-job/policy.rego:571: allow_var 2: p_var2 = var1=val1", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-job/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-job/policy.rego:556: allow_env: true", + "tests/kata/data/k8s-policy-job/policy.rego:473: allow_process: true", + "tests/kata/data/k8s-policy-job/policy.rego:165: allow_by_sandbox_name: true", + "tests/kata/data/k8s-policy-job/policy.rego:134: allow_by_anno 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-job/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-job/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/k8s-policy-job/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/k8s-policy-job/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-job/policy.rego:352: allow_masked_paths 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:355: allow_masked_paths 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-job/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-job/policy.rego:424: allow_readonly_path 2: true", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-job/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-job/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-job/policy.rego:389: allow_readonly_paths 1: true", + "tests/kata/data/k8s-policy-job/policy.rego:392: allow_readonly_paths 2: start", + "tests/kata/data/k8s-policy-job/policy.rego:340: allow_linux: true", + "tests/kata/data/k8s-policy-job/policy.rego:79: CreateContainerRequest: true" + ], + [], + [], + [], + [], + [] +] \ No newline at end of file diff --git a/tests/kata/data/k8s-policy-pod/prints.json b/tests/kata/data/k8s-policy-pod/prints.json new file mode 100644 index 0000000..7326977 --- /dev/null +++ b/tests/kata/data/k8s-policy-pod/prints.json @@ -0,0 +1,999 @@ +[ + [], + [], + [], + [ + "tests/kata/data/k8s-policy-pod/policy.rego:1046: CreateSandboxRequest: i_pidns = false" + ], + [], + [ + "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/k8s-policy-pod/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-pod_f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-3e413870-ed7b-d970-7440-cc55c7795613\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:143: allow_by_anno 2: i_s_name = policy-pod p_s_name = policy-pod", + "tests/kata/data/k8s-policy-pod/policy.rego:169: allow_sandbox_name 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:173: allow_sandbox_name 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:176: allow_sandbox_name 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-pod/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-pod/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-pod/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/k8s-policy-pod/policy.rego:205: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/k8s-policy-pod/policy.rego:209: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/k8s-policy-pod/policy.rego:236: allow_sandbox_container_name: start", + "tests/kata/data/k8s-policy-pod/policy.rego:252: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-pod/policy.rego:257: container_annotation_missing: true", + "tests/kata/data/k8s-policy-pod/policy.rego:240: allow_sandbox_container_name: true", + "tests/kata/data/k8s-policy-pod/policy.rego:274: allow_sandbox_net_namespace: start", + "tests/kata/data/k8s-policy-pod/policy.rego:280: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-3e413870-ed7b-d970-7440-cc55c7795613", + "tests/kata/data/k8s-policy-pod/policy.rego:284: allow_sandbox_net_namespace: true", + "tests/kata/data/k8s-policy-pod/policy.rego:300: allow_sandbox_log_directory: start", + "tests/kata/data/k8s-policy-pod/policy.rego:307: allow_sandbox_log_directory: regex2 = ^/var/log/pods/kata-containers-k8s-tests_policy-pod_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/k8s-policy-pod/policy.rego:310: allow_sandbox_log_directory: i_dir = /var/log/pods/kata-containers-k8s-tests_policy-pod_f7641c61-8a63-4bc6-98b9-6a4a5b0d860a", + "tests/kata/data/k8s-policy-pod/policy.rego:314: allow_sandbox_log_directory: true", + "tests/kata/data/k8s-policy-pod/policy.rego:216: allow_by_container_type 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:220: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/k8s-policy-pod/policy.rego:201: allow_by_container_types: true", + "tests/kata/data/k8s-policy-pod/policy.rego:430: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/k8s-policy-pod/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2 regex = ^[a-z0-9]{64}$", + "tests/kata/data/k8s-policy-pod/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-pod/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-pod/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2/rootfs", + "tests/kata/data/k8s-policy-pod/policy.rego:711: allow_root_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = proc", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = proc", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2-c9c9b9dc84433468-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:452: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/k8s-policy-pod/policy.rego:459: allow_process: i terminal = false p terminal = false", + "tests/kata/data/k8s-policy-pod/policy.rego:462: allow_process: i cwd = / i cwd = /", + "tests/kata/data/k8s-policy-pod/policy.rego:465: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/k8s-policy-pod/policy.rego:982: allow_caps: policy Ambient = []", + "tests/kata/data/k8s-policy-pod/policy.rego:983: allow_caps: input Ambient = []", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:994: allow_caps: policy Inheritable = []", + "tests/kata/data/k8s-policy-pod/policy.rego:995: allow_caps: input Inheritable = []", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:497: allow_args 1: no args", + "tests/kata/data/k8s-policy-pod/policy.rego:505: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:506: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:518: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-pod/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:527: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-pod/policy.rego:536: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-pod/policy.rego:540: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/k8s-policy-pod/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:514: allow_args 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:556: allow_env: true", + "tests/kata/data/k8s-policy-pod/policy.rego:473: allow_process: true", + "tests/kata/data/k8s-policy-pod/policy.rego:165: allow_by_sandbox_name: true", + "tests/kata/data/k8s-policy-pod/policy.rego:148: allow_by_anno 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-pod/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-pod/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/sys/devices/virtual/powercap\", \"/proc/scsi\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:352: allow_masked_paths 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:355: allow_masked_paths 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-pod/policy.rego:389: allow_readonly_paths 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:392: allow_readonly_paths 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:340: allow_linux: true", + "tests/kata/data/k8s-policy-pod/policy.rego:79: CreateContainerRequest: true", + "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [], + [], + [ + "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/k8s-policy-pod/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-pod/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:143: allow_by_anno 2: i_s_name = policy-pod p_s_name = policy-pod", + "tests/kata/data/k8s-policy-pod/policy.rego:169: allow_sandbox_name 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:173: allow_sandbox_name 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:176: allow_sandbox_name 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-pod/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-pod/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-pod/policy.rego:196: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/k8s-policy-pod/policy.rego:205: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/k8s-policy-pod/policy.rego:220: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/k8s-policy-pod/policy.rego:224: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/k8s-policy-pod/policy.rego:244: allow_container_name: start", + "tests/kata/data/k8s-policy-pod/policy.rego:261: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-pod/policy.rego:265: allow_container_annotation: p_value = busybox i_value = busybox", + "tests/kata/data/k8s-policy-pod/policy.rego:269: allow_container_annotation: true", + "tests/kata/data/k8s-policy-pod/policy.rego:248: allow_container_name: true", + "tests/kata/data/k8s-policy-pod/policy.rego:288: allow_net_namespace: start", + "tests/kata/data/k8s-policy-pod/policy.rego:295: allow_net_namespace: true", + "tests/kata/data/k8s-policy-pod/policy.rego:318: allow_log_directory: start", + "tests/kata/data/k8s-policy-pod/policy.rego:325: allow_log_directory: true", + "tests/kata/data/k8s-policy-pod/policy.rego:231: allow_by_container_type 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:201: allow_by_container_types: true", + "tests/kata/data/k8s-policy-pod/policy.rego:430: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/k8s-policy-pod/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2 regex = ^[a-z0-9]{64}$", + "tests/kata/data/k8s-policy-pod/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-pod/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-pod/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9/rootfs", + "tests/kata/data/k8s-policy-pod/policy.rego:711: allow_root_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = proc", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = proc", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-b0241970194aa0f1-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-hosts$", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-70afdd32aae261c9-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-termination-log$", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-cdfc9069abab6aa0-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-hostname$", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-a9ad9599a85707b3-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-5f0e5e3718c35792-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-pod/policy.rego:452: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/k8s-policy-pod/policy.rego:459: allow_process: i terminal = false p terminal = false", + "tests/kata/data/k8s-policy-pod/policy.rego:462: allow_process: i cwd = / i cwd = /", + "tests/kata/data/k8s-policy-pod/policy.rego:465: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/k8s-policy-pod/policy.rego:982: allow_caps: policy Ambient = []", + "tests/kata/data/k8s-policy-pod/policy.rego:983: allow_caps: input Ambient = []", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:994: allow_caps: policy Inheritable = []", + "tests/kata/data/k8s-policy-pod/policy.rego:995: allow_caps: input Inheritable = []", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-pod/policy.rego:497: allow_args 1: no args", + "tests/kata/data/k8s-policy-pod/policy.rego:505: allow_args 2: policy args = [\"sh\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:506: allow_args 2: input args = [\"sh\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:518: allow_arg 1: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/k8s-policy-pod/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:527: allow_arg 2: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/k8s-policy-pod/policy.rego:536: allow_arg 3: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/k8s-policy-pod/policy.rego:540: allow_arg 3: p_arg3 = sh", + "tests/kata/data/k8s-policy-pod/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:514: allow_args 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"KUBE_CONFIG_1=value-1\", \"KUBE_CONFIG_2=value-2\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=policy-pod\", \"KUBE_CONFIG_1=value-1\", \"KUBE_CONFIG_2=value-2\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = HOSTNAME=policy-pod", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:619: allow_var 5: true", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", + "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-pod/policy.rego:556: allow_env: true", + "tests/kata/data/k8s-policy-pod/policy.rego:473: allow_process: true", + "tests/kata/data/k8s-policy-pod/policy.rego:165: allow_by_sandbox_name: true", + "tests/kata/data/k8s-policy-pod/policy.rego:148: allow_by_anno 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-pod/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-pod/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-pod/policy.rego:352: allow_masked_paths 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:355: allow_masked_paths 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-pod/policy.rego:424: allow_readonly_path 2: true", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-pod/policy.rego:389: allow_readonly_paths 1: true", + "tests/kata/data/k8s-policy-pod/policy.rego:392: allow_readonly_paths 2: start", + "tests/kata/data/k8s-policy-pod/policy.rego:340: allow_linux: true", + "tests/kata/data/k8s-policy-pod/policy.rego:79: CreateContainerRequest: true" + ], + [], + [], + [], + [], + [] +] \ No newline at end of file diff --git a/tests/kata/data/k8s-policy-rc/prints.json b/tests/kata/data/k8s-policy-rc/prints.json new file mode 100644 index 0000000..2c4a1dc --- /dev/null +++ b/tests/kata/data/k8s-policy-rc/prints.json @@ -0,0 +1,1000 @@ +[ + [], + [], + [], + [ + "tests/kata/data/k8s-policy-rc/policy.rego:1046: CreateSandboxRequest: i_pidns = false" + ], + [], + [ + "tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/k8s-policy-rc/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-rc-test-674df_eeb60852-0dcd-4387-b0f9-eebd63ddb7a8\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-rc-test-674df\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"eeb60852-0dcd-4387-b0f9-eebd63ddb7a8\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-939f1f21-5cec-1599-6804-471950c9c843\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:130: allow_by_anno 1: i_s_name = policy-rc-test-674df", + "tests/kata/data/k8s-policy-rc/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-rc/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-rc/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-rc/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/k8s-policy-rc/policy.rego:205: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/k8s-policy-rc/policy.rego:209: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/k8s-policy-rc/policy.rego:236: allow_sandbox_container_name: start", + "tests/kata/data/k8s-policy-rc/policy.rego:252: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-rc/policy.rego:257: container_annotation_missing: true", + "tests/kata/data/k8s-policy-rc/policy.rego:240: allow_sandbox_container_name: true", + "tests/kata/data/k8s-policy-rc/policy.rego:274: allow_sandbox_net_namespace: start", + "tests/kata/data/k8s-policy-rc/policy.rego:280: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-939f1f21-5cec-1599-6804-471950c9c843", + "tests/kata/data/k8s-policy-rc/policy.rego:284: allow_sandbox_net_namespace: true", + "tests/kata/data/k8s-policy-rc/policy.rego:300: allow_sandbox_log_directory: start", + "tests/kata/data/k8s-policy-rc/policy.rego:307: allow_sandbox_log_directory: regex2 = ^/var/log/pods/kata-containers-k8s-tests_policy-rc-test-674df_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/k8s-policy-rc/policy.rego:310: allow_sandbox_log_directory: i_dir = /var/log/pods/kata-containers-k8s-tests_policy-rc-test-674df_eeb60852-0dcd-4387-b0f9-eebd63ddb7a8", + "tests/kata/data/k8s-policy-rc/policy.rego:314: allow_sandbox_log_directory: true", + "tests/kata/data/k8s-policy-rc/policy.rego:216: allow_by_container_type 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:220: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/k8s-policy-rc/policy.rego:201: allow_by_container_types: true", + "tests/kata/data/k8s-policy-rc/policy.rego:430: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/k8s-policy-rc/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5 regex = ^[a-z0-9]{64}$", + "tests/kata/data/k8s-policy-rc/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-rc/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-rc/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs", + "tests/kata/data/k8s-policy-rc/policy.rego:711: allow_root_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = proc", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = proc", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5-e1c85415dcc483c7-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:452: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/k8s-policy-rc/policy.rego:459: allow_process: i terminal = false p terminal = false", + "tests/kata/data/k8s-policy-rc/policy.rego:462: allow_process: i cwd = / i cwd = /", + "tests/kata/data/k8s-policy-rc/policy.rego:465: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/k8s-policy-rc/policy.rego:982: allow_caps: policy Ambient = []", + "tests/kata/data/k8s-policy-rc/policy.rego:983: allow_caps: input Ambient = []", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:994: allow_caps: policy Inheritable = []", + "tests/kata/data/k8s-policy-rc/policy.rego:995: allow_caps: input Inheritable = []", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:497: allow_args 1: no args", + "tests/kata/data/k8s-policy-rc/policy.rego:505: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:506: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:514: allow_args 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:556: allow_env: true", + "tests/kata/data/k8s-policy-rc/policy.rego:473: allow_process: true", + "tests/kata/data/k8s-policy-rc/policy.rego:165: allow_by_sandbox_name: true", + "tests/kata/data/k8s-policy-rc/policy.rego:134: allow_by_anno 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-rc/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-rc/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/sys/devices/virtual/powercap\", \"/proc/scsi\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:352: allow_masked_paths 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:355: allow_masked_paths 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-rc/policy.rego:389: allow_readonly_paths 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:392: allow_readonly_paths 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:340: allow_linux: true", + "tests/kata/data/k8s-policy-rc/policy.rego:79: CreateContainerRequest: true", + "tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [], + [], + [ + "tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", + "tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/k8s-policy-rc/policy.rego:84: allow_anno 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginxtest\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/sjenning/nginx:1.15-alpine\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginxtest\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/sjenning/nginx:1.15-alpine\", \"io.kubernetes.cri.sandbox-id\": \"c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5\", \"io.kubernetes.cri.sandbox-name\": \"policy-rc-test-674df\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"eeb60852-0dcd-4387-b0f9-eebd63ddb7a8\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/k8s-policy-rc/policy.rego:101: allow_anno 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:123: allow_by_anno 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:130: allow_by_anno 1: i_s_name = policy-rc-test-674df", + "tests/kata/data/k8s-policy-rc/policy.rego:152: allow_by_sandbox_name: start", + "tests/kata/data/k8s-policy-rc/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", + "tests/kata/data/k8s-policy-rc/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/k8s-policy-rc/policy.rego:196: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/k8s-policy-rc/policy.rego:205: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/k8s-policy-rc/policy.rego:220: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/k8s-policy-rc/policy.rego:224: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/k8s-policy-rc/policy.rego:244: allow_container_name: start", + "tests/kata/data/k8s-policy-rc/policy.rego:261: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/k8s-policy-rc/policy.rego:265: allow_container_annotation: p_value = nginxtest i_value = nginxtest", + "tests/kata/data/k8s-policy-rc/policy.rego:269: allow_container_annotation: true", + "tests/kata/data/k8s-policy-rc/policy.rego:248: allow_container_name: true", + "tests/kata/data/k8s-policy-rc/policy.rego:288: allow_net_namespace: start", + "tests/kata/data/k8s-policy-rc/policy.rego:295: allow_net_namespace: true", + "tests/kata/data/k8s-policy-rc/policy.rego:318: allow_log_directory: start", + "tests/kata/data/k8s-policy-rc/policy.rego:325: allow_log_directory: true", + "tests/kata/data/k8s-policy-rc/policy.rego:231: allow_by_container_type 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:201: allow_by_container_types: true", + "tests/kata/data/k8s-policy-rc/policy.rego:430: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/k8s-policy-rc/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5 regex = ^[a-z0-9]{64}$", + "tests/kata/data/k8s-policy-rc/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-rc/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", + "tests/kata/data/k8s-policy-rc/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e/rootfs", + "tests/kata/data/k8s-policy-rc/policy.rego:711: allow_root_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = proc", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = proc", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs/local/host-empty-vol\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/$(sandbox-id)/rootfs/local/host-empty-vol$", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs/local/host-empty-vol$", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-01336f00e960a39f-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-hosts$", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-90afc9ee3516c39f-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-termination-log$", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-094a24e380ead97f-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-hostname$", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-530431b992f6d296-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-cb7632a83c5a9dc3-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}", + "tests/kata/data/k8s-policy-rc/policy.rego:452: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/k8s-policy-rc/policy.rego:459: allow_process: i terminal = false p terminal = false", + "tests/kata/data/k8s-policy-rc/policy.rego:462: allow_process: i cwd = / i cwd = /", + "tests/kata/data/k8s-policy-rc/policy.rego:465: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/k8s-policy-rc/policy.rego:982: allow_caps: policy Ambient = []", + "tests/kata/data/k8s-policy-rc/policy.rego:983: allow_caps: input Ambient = []", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:994: allow_caps: policy Inheritable = []", + "tests/kata/data/k8s-policy-rc/policy.rego:995: allow_caps: input Inheritable = []", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start", + "tests/kata/data/k8s-policy-rc/policy.rego:497: allow_args 1: no args", + "tests/kata/data/k8s-policy-rc/policy.rego:505: allow_args 2: policy args = [\"nginx\", \"-g\", \"daemon off;\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:506: allow_args 2: input args = [\"nginx\", \"-g\", \"daemon off;\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 0 i_arg = nginx p_arg = nginx", + "tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 0 i_arg = nginx p_arg = nginx", + "tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 0 i_arg = nginx p_arg = nginx", + "tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = nginx", + "tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 1 i_arg = -g p_arg = -g", + "tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 1 i_arg = -g p_arg = -g", + "tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 1 i_arg = -g p_arg = -g", + "tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = -g", + "tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 2 i_arg = daemon off; p_arg = daemon off;", + "tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 2 i_arg = daemon off; p_arg = daemon off;", + "tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 2 i_arg = daemon off; p_arg = daemon off;", + "tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = daemon off;", + "tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:514: allow_args 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"NGINX_VERSION=1.15.12\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=policy-rc-test-674df\", \"NGINX_VERSION=1.15.12\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = HOSTNAME=policy-rc-test-674df", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:619: allow_var 5: true", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:563: allow_var 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:574: allow_var 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12", + "tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", + "tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/k8s-policy-rc/policy.rego:556: allow_env: true", + "tests/kata/data/k8s-policy-rc/policy.rego:473: allow_process: true", + "tests/kata/data/k8s-policy-rc/policy.rego:165: allow_by_sandbox_name: true", + "tests/kata/data/k8s-policy-rc/policy.rego:134: allow_by_anno 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:137: allow_by_anno 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-rc/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/k8s-policy-rc/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true", + "tests/kata/data/k8s-policy-rc/policy.rego:352: allow_masked_paths 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:355: allow_masked_paths 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/k8s-policy-rc/policy.rego:424: allow_readonly_path 2: true", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/k8s-policy-rc/policy.rego:389: allow_readonly_paths 1: true", + "tests/kata/data/k8s-policy-rc/policy.rego:392: allow_readonly_paths 2: start", + "tests/kata/data/k8s-policy-rc/policy.rego:340: allow_linux: true", + "tests/kata/data/k8s-policy-rc/policy.rego:79: CreateContainerRequest: true" + ], + [], + [], + [], + [], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-cm1/prints.json b/tests/kata/data/pod-cm1/prints.json new file mode 100644 index 0000000..6b55af3 --- /dev/null +++ b/tests/kata/data/pod-cm1/prints.json @@ -0,0 +1,1216 @@ +[ + [], + [], + [], + [ + "tests/kata/data/pod-cm1/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-cm1/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-cm1/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-cm1/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-cm1/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-cm1/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-cm1/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-cm1/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f-fcc2557fcee4b4da-resolv.conf", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-cm1/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-cm1/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm1/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-cm1/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm1/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-cm1/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm1/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"cm1\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-cm1/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_cm1_7629e87a-0528-40c7-ac9e-fdf4bc202f8d\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"cm1\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"7629e87a-0528-40c7-ac9e-fdf4bc202f8d\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-99c9b587-9b06-f81a-a10c-2bd71ba4de0a\"}", + "tests/kata/data/pod-cm1/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm1/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm1/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm1/policy.rego:149: allow_by_anno 2: i_s_name = cm1 p_s_name = cm1", + "tests/kata/data/pod-cm1/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm1/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm1/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm1/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm1/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm1/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm1/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-cm1/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-cm1/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-cm1/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-cm1/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm1/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-cm1/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-cm1/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-cm1/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-99c9b587-9b06-f81a-a10c-2bd71ba4de0a", + "tests/kata/data/pod-cm1/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-cm1/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-cm1/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_cm1_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-cm1/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_cm1_7629e87a-0528-40c7-ac9e-fdf4bc202f8d", + "tests/kata/data/pod-cm1/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-cm1/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-cm1/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-cm1/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-cm1/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-cm1/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-cm1/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-cm1/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-cm1/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f", + "tests/kata/data/pod-cm1/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-cm1/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-cm1/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-cm1/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-cm1/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f-fcc2557fcee4b4da-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f-fcc2557fcee4b4da-resolv.conf", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-cm1/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-cm1/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm1/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm1/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-cm1/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm1/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm1/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm1/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm1/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm1/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm1/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm1/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-cm1/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-cm1/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-cm1/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-cm1/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-cm1/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-cm1/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-cm1/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-cm1/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-cm1/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm1/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm1/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm1/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-cm1/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm1/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm1/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm1/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f", + "tests/kata/data/pod-cm1/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-cm1/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f", + "tests/kata/data/pod-cm1/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm1/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm1/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm1/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-cm1/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-cm1/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-cm1/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-cm1/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-cm1/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-cm1/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm1/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm1/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm1/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm1/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-cm1/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm1/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm1/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:485: allow_user: input uid = 2000 policy uid = 2000", + "tests/kata/data/pod-cm1/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-cm1/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-cm1/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-cm1/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-cm1/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm1/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-cm1/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-cm1/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-cm1/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm1/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-cm1/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-cm1/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:558: allow_env: true", + "tests/kata/data/pod-cm1/policy.rego:478: allow_process: true", + "tests/kata/data/pod-cm1/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-cm1/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-cm1/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm1/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm1/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-cm1/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-cm1/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm1/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-cm1/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-cm1/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm1/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm1/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-cm1/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm1/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-cm1/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-cm1/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm1/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-cm1/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-cm1/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm1/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-cm1/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-cm1/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm1/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-cm1/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm1/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm1/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm1/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-cm1/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-cm1/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-cm1/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-cm1/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm1/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-cm1/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm1/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-d7237018b1bd6306-hosts", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-7ff34bb27061c9d6-termination-log", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-aefaf093e301d5c1-hostname", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-c8a426b90b41420f-resolv.conf", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/..2024_05_08_18_00_29.1625327705", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/..2024_05_08_18_00_29.1625327705/ca.crt", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/..2024_05_08_18_00_29.1625327705/namespace", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/..2024_05_08_18_00_29.1625327705/token", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/..data", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_00_29.1625327705", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/ca.crt", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/namespace", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount/token", + "tests/kata/data/pod-cm1/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-cm1/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm1/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm1/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-cm1/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-cm1/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm1/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-cm1/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm1/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-cm1/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm1/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-cm1/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm1/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-cm1/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm1/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"cm1\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-cm1/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f\", \"io.kubernetes.cri.sandbox-name\": \"cm1\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"7629e87a-0528-40c7-ac9e-fdf4bc202f8d\"}", + "tests/kata/data/pod-cm1/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm1/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm1/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm1/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm1/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm1/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm1/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm1/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm1/policy.rego:149: allow_by_anno 2: i_s_name = cm1 p_s_name = cm1", + "tests/kata/data/pod-cm1/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm1/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm1/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm1/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm1/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm1/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm1/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-cm1/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-cm1/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-cm1/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-cm1/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-cm1/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm1/policy.rego:271: allow_container_annotation: p_value = busybox i_value = busybox", + "tests/kata/data/pod-cm1/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-cm1/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-cm1/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-cm1/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-cm1/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-cm1/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-cm1/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-cm1/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-cm1/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-cm1/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 7378f298b0f0745329680eba807f4e8283813bc5d38918fb10d0b596fc7e411f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-cm1/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-cm1/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-cm1/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8", + "tests/kata/data/pod-cm1/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-cm1/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-cm1/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-cm1/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-cm1/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-d7237018b1bd6306-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-d7237018b1bd6306-hosts", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-7ff34bb27061c9d6-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-7ff34bb27061c9d6-termination-log", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-aefaf093e301d5c1-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-aefaf093e301d5c1-hostname", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-c8a426b90b41420f-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-c8a426b90b41420f-resolv.conf", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm1/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-cm1/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm1/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-cm1/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8-f6e224b8e9e0262c-serviceaccount", + "tests/kata/data/pod-cm1/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm1/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm1/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm1/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-cm1/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-cm1/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm1/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm1/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-cm1/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm1/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm1/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm1/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm1/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm1/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm1/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm1/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-cm1/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-cm1/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-cm1/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-cm1/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm1/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-cm1/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm1/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-cm1/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm1/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm1/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm1/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm1/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm1/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm1/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm1/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-cm1/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-cm1/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-cm1/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm1/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm1/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm1/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm1/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm1/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-cm1/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-cm1/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-cm1/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-cm1/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-cm1/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-cm1/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm1/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm1/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm1/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-cm1/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm1/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm1/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm1/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm1/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-cm1/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm1/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm1/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm1/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-cm1/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm1/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm1/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8", + "tests/kata/data/pod-cm1/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-cm1/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/e0735049b06564545e5d65b9cb5ef0504ed9b5591b4c3ab224f650347745fdc8", + "tests/kata/data/pod-cm1/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm1/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm1/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm1/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-cm1/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-cm1/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-cm1/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-cm1/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-cm1/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-cm1/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1056: allow_caps: policy Bounding = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-cm1/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-cm1/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-cm1/policy.rego:1060: allow_caps: policy Effective = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-cm1/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-cm1/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-cm1/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-cm1/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1068: allow_caps: policy Permitted = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-cm1/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-cm1/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm1/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm1/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm1/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-cm1/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-cm1/policy.rego:485: allow_user: input uid = 2000 policy uid = 2000", + "tests/kata/data/pod-cm1/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-cm1/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-cm1/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-cm1/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm1/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm1/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm1/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm1/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-cm1/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm1/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm1/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm1/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm1/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm1/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-cm1/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm1/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm1/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm1/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm1/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm1/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm1/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm1/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-cm1/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"CONFIG_MAP_VALUE1=value1\"]", + "tests/kata/data/pod-cm1/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=cm1\", \"CONFIG_MAP_VALUE1=value1\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\"]", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = HOSTNAME=cm1", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm1/policy.rego:573: allow_var 2: p_var2 = CONFIG_MAP_VALUE1=value1", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm1/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm1/policy.rego:558: allow_env: true", + "tests/kata/data/pod-cm1/policy.rego:478: allow_process: true", + "tests/kata/data/pod-cm1/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-cm1/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-cm1/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm1/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm1/policy.rego:351: allow_masked_paths 1: p_paths = []", + "tests/kata/data/pod-cm1/policy.rego:354: allow_masked_paths 1: i_paths = []", + "tests/kata/data/pod-cm1/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-cm1/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-cm1/policy.rego:388: allow_readonly_paths 1: p_paths = []", + "tests/kata/data/pod-cm1/policy.rego:391: allow_readonly_paths 1: i_paths = []", + "tests/kata/data/pod-cm1/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-cm1/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-cm1/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-cm1/policy.rego:85: CreateContainerRequest: true" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-cm2/prints.json b/tests/kata/data/pod-cm2/prints.json new file mode 100644 index 0000000..b47bff6 --- /dev/null +++ b/tests/kata/data/pod-cm2/prints.json @@ -0,0 +1,2400 @@ +[ + [], + [], + [], + [ + "tests/kata/data/pod-cm2/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-cm2/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-cm2/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-cm2/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-cm2/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-cm2/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-cm2/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-cm2/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f-436c8044ae5d2eea-resolv.conf", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-cm2/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-cm2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm2/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-cm2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-cm2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_cm2_e171518a-2666-434f-86bb-1b067839f6e9\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"e171518a-2666-434f-86bb-1b067839f6e9\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-f5c9d075-80ce-76f2-5578-94f4feab0a46\"}", + "tests/kata/data/pod-cm2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm2/policy.rego:149: allow_by_anno 2: i_s_name = cm2 p_s_name = cm2", + "tests/kata/data/pod-cm2/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm2/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm2/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-cm2/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-cm2/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-cm2/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-cm2/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-cm2/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-cm2/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-cm2/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-f5c9d075-80ce-76f2-5578-94f4feab0a46", + "tests/kata/data/pod-cm2/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-cm2/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-cm2/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_cm2_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-cm2/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_cm2_e171518a-2666-434f-86bb-1b067839f6e9", + "tests/kata/data/pod-cm2/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-cm2/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-cm2/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-cm2/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-cm2/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-cm2/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-cm2/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-cm2/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-cm2/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f", + "tests/kata/data/pod-cm2/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-cm2/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-cm2/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-cm2/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-cm2/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f-436c8044ae5d2eea-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f-436c8044ae5d2eea-resolv.conf", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-cm2/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-cm2/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-cm2/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-cm2/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-cm2/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-cm2/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-cm2/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-cm2/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-cm2/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm2/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-cm2/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-cm2/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm2/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-cm2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm2/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f", + "tests/kata/data/pod-cm2/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-cm2/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-cm2/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-cm2/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-cm2/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-cm2/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-cm2/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-cm2/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/pod-cm2/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-cm2/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-cm2/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-cm2/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-cm2/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:558: allow_env: true", + "tests/kata/data/pod-cm2/policy.rego:478: allow_process: true", + "tests/kata/data/pod-cm2/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-cm2/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm2/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm2/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-cm2/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-cm2/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-cm2/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm2/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm2/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-cm2/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-cm2/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = false", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = false" + ], + [], + [], + [], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2/..2024_05_08_18_01_52.2860902433", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2/..2024_05_08_18_01_52.2860902433/my-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2/..data", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_01_52.2860902433", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2/my-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/my-keys", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3/..2024_05_08_18_01_52.1069278790", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3/..2024_05_08_18_01_52.1069278790/ro-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3/..data", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_01_52.1069278790", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3/ro-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/ro-keys", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-3bb8d220ffb1f5e1-hosts", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-ce6c29c68dc0cc49-termination-log", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-9be63438a9eb2789-hostname", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-8a053bb7df8eff93-resolv.conf", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/..2024_05_08_18_01_52.3435451574", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/..2024_05_08_18_01_52.3435451574/ca.crt", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/..2024_05_08_18_01_52.3435451574/namespace", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/..2024_05_08_18_01_52.3435451574/token", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/..data", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_01_52.3435451574", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/ca.crt", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/namespace", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount/token", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-cm2/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = true", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = true", + "tests/kata/data/pod-cm2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm2/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-cm2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-cm2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"e171518a-2666-434f-86bb-1b067839f6e9\"}", + "tests/kata/data/pod-cm2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm2/policy.rego:149: allow_by_anno 2: i_s_name = cm2 p_s_name = cm2", + "tests/kata/data/pod-cm2/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm2/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm2/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-cm2/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-cm2/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:271: allow_container_annotation: p_value = busybox i_value = busybox", + "tests/kata/data/pod-cm2/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-cm2/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-cm2/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-cm2/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-cm2/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-cm2/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-cm2/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-cm2/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-cm2/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-cm2/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-cm2/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-cm2/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-cm2/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87", + "tests/kata/data/pod-cm2/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-cm2/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-cm2/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-cm2/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-cm2/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-cm2$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-cm2$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-a09a9af9b15c5fdd-cm2", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-cm3$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-cm3$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-4ef29a1284058a8c-cm3", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-3bb8d220ffb1f5e1-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-3bb8d220ffb1f5e1-hosts", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-ce6c29c68dc0cc49-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-ce6c29c68dc0cc49-termination-log", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-9be63438a9eb2789-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-9be63438a9eb2789-hostname", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-8a053bb7df8eff93-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-8a053bb7df8eff93-resolv.conf", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87-5ac80405797363af-serviceaccount", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-cm2/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-cm2/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-cm2/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-cm2/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-cm2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-cm2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-cm2/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-cm2/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-cm2/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-cm2/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-cm2/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-cm2/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-cm2/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm2/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-cm2/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm2/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87", + "tests/kata/data/pod-cm2/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-cm2/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-cm2/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-cm2/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-cm2/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-cm2/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-cm2/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-cm2/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:485: allow_user: input uid = 123 policy uid = 123", + "tests/kata/data/pod-cm2/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-cm2/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-cm2/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-cm2/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-cm2/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=cm2\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\"]", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = HOSTNAME=cm2", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:558: allow_env: true", + "tests/kata/data/pod-cm2/policy.rego:478: allow_process: true", + "tests/kata/data/pod-cm2/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-cm2/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm2/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm2/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-cm2/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-cm2/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-cm2/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm2/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-cm2/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm2/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-cm2/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-cm2/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = true", + "tests/kata/data/pod-cm2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm2/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-cm2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-cm2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"e171518a-2666-434f-86bb-1b067839f6e9\"}", + "tests/kata/data/pod-cm2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm2/policy.rego:149: allow_by_anno 2: i_s_name = cm2 p_s_name = cm2", + "tests/kata/data/pod-cm2/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm2/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm2/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-cm2/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-cm2/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox" + ], + [], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2/..2024_05_08_18_01_52.2860902433", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2/..2024_05_08_18_01_52.2860902433/my-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2/..data", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_01_52.2860902433", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2/my-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/my-keys", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3/..2024_05_08_18_01_52.1069278790", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3/..2024_05_08_18_01_52.1069278790/ro-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3/..data", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_01_52.1069278790", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3/ro-keys", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/ro-keys", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-f749cedf36bddf3c-hosts", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-f0d8a25662250ce8-termination-log", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-249cc2af2c1bfc4b-hostname", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-dc4288323e5a92bc-resolv.conf", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/..2024_05_08_18_01_52.3435451574", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/..2024_05_08_18_01_52.3435451574/ca.crt", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/..2024_05_08_18_01_52.3435451574/namespace", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/..2024_05_08_18_01_52.3435451574/token", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/..data", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_01_52.3435451574", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/ca.crt", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/namespace", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount/token", + "tests/kata/data/pod-cm2/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-cm2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-cm2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-cm2/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-cm2/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = true", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = true", + "tests/kata/data/pod-cm2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm2/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-cm2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-cm2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"e171518a-2666-434f-86bb-1b067839f6e9\"}", + "tests/kata/data/pod-cm2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm2/policy.rego:149: allow_by_anno 2: i_s_name = cm2 p_s_name = cm2", + "tests/kata/data/pod-cm2/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm2/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm2/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-cm2/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-cm2/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:271: allow_container_annotation: p_value = busybox i_value = busybox2", + "tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = true", + "tests/kata/data/pod-cm2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-cm2/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-cm2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-cm2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"e171518a-2666-434f-86bb-1b067839f6e9\"}", + "tests/kata/data/pod-cm2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-cm2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-cm2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-cm2/policy.rego:149: allow_by_anno 2: i_s_name = cm2 p_s_name = cm2", + "tests/kata/data/pod-cm2/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-cm2/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-cm2/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-cm2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-cm2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-cm2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-cm2/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-cm2/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-cm2/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-cm2/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-cm2/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox2", + "tests/kata/data/pod-cm2/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-cm2/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-cm2/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-cm2/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-cm2/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-cm2/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-cm2/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-cm2/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-cm2/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-cm2/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-cm2/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-cm2/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-cm2/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4", + "tests/kata/data/pod-cm2/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-cm2/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-cm2/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-cm2/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-cm2/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-cm2$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-cm2$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-6f93198617aff717-cm2", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-cm3$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-cm3$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-ec595582efe8286f-cm3", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-f749cedf36bddf3c-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-f749cedf36bddf3c-hosts", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-f0d8a25662250ce8-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-f0d8a25662250ce8-termination-log", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-249cc2af2c1bfc4b-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-249cc2af2c1bfc4b-hostname", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-dc4288323e5a92bc-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-dc4288323e5a92bc-resolv.conf", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-cm2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-cm2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-cm2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4-7ade70f5e8616378-serviceaccount", + "tests/kata/data/pod-cm2/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-cm2/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm2\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/cm3\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)cm3$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-cm2/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-cm2/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-cm2/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-cm2/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-cm2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-cm2/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-cm2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-cm2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-cm2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-cm2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-cm2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-cm2/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-cm2/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-cm2/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-cm2/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-cm2/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-cm2/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-cm2/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-cm2/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-cm2/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-cm2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm2/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-cm2/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-cm2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-cm2/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-cm2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-cm2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-cm2/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4", + "tests/kata/data/pod-cm2/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-cm2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/b8e0140601d37a8f5bce5b137d48b96e730c0645e85748fa2f8afcf79fbe37c4", + "tests/kata/data/pod-cm2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-cm2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-cm2/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-cm2/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-cm2/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-cm2/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-cm2/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-cm2/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-cm2/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-cm2/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-cm2/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-cm2/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-cm2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-cm2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-cm2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-cm2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-cm2/policy.rego:485: allow_user: input uid = 321 policy uid = 321", + "tests/kata/data/pod-cm2/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-cm2/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-cm2/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-cm2/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-cm2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-cm2/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-cm2/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-cm2/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=cm2\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\"]", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = HOSTNAME=cm2", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-cm2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-cm2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-cm2/policy.rego:558: allow_env: true", + "tests/kata/data/pod-cm2/policy.rego:478: allow_process: true", + "tests/kata/data/pod-cm2/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-cm2/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-cm2/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm2/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-cm2/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-cm2/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-cm2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-cm2/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-cm2/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-cm2/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm2/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-cm2/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-cm2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-cm2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-cm2/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-cm2/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-cm2/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-exec/prints.json b/tests/kata/data/pod-exec/prints.json new file mode 100644 index 0000000..bb53481 --- /dev/null +++ b/tests/kata/data/pod-exec/prints.json @@ -0,0 +1,1910 @@ +[ + [], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-exec/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-exec/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-exec/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-exec/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-exec/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-exec/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-exec/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b-d96ce56341b7838c-resolv.conf", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-exec/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-exec/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-exec/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-exec/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-exec/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-exec/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-exec/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"exec-test\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-exec/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_exec-test_ada2ca20-1a14-42b4-ae7e-f1a45d63fa33\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"exec-test\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"ada2ca20-1a14-42b4-ae7e-f1a45d63fa33\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-f24f98bd-565d-85de-43fc-629d7e43d846\"}", + "tests/kata/data/pod-exec/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-exec/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-exec/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-exec/policy.rego:149: allow_by_anno 2: i_s_name = exec-test p_s_name = exec-test", + "tests/kata/data/pod-exec/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-exec/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-exec/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-exec/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-exec/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-exec/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-exec/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-exec/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-exec/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-exec/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-exec/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-exec/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-exec/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-exec/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-exec/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-f24f98bd-565d-85de-43fc-629d7e43d846", + "tests/kata/data/pod-exec/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-exec/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-exec/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_exec-test_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-exec/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_exec-test_ada2ca20-1a14-42b4-ae7e-f1a45d63fa33", + "tests/kata/data/pod-exec/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-exec/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-exec/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-exec/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-exec/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-exec/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-exec/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-exec/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-exec/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b", + "tests/kata/data/pod-exec/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-exec/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-exec/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-exec/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-exec/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b-d96ce56341b7838c-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b-d96ce56341b7838c-resolv.conf", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-exec/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-exec/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-exec/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-exec/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-exec/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-exec/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-exec/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-exec/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-exec/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-exec/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-exec/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-exec/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-exec/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-exec/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-exec/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-exec/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-exec/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-exec/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-exec/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-exec/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-exec/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-exec/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-exec/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-exec/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-exec/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-exec/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-exec/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-exec/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b", + "tests/kata/data/pod-exec/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-exec/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b", + "tests/kata/data/pod-exec/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-exec/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-exec/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-exec/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-exec/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-exec/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-exec/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-exec/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-exec/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-exec/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-exec/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-exec/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-exec/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-exec/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-exec/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-exec/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-exec/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/pod-exec/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-exec/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-exec/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-exec/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-exec/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-exec/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-exec/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-exec/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-exec/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-exec/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-exec/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-exec/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:558: allow_env: true", + "tests/kata/data/pod-exec/policy.rego:478: allow_process: true", + "tests/kata/data/pod-exec/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-exec/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-exec/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-exec/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-exec/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-exec/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-exec/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-exec/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-exec/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-exec/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-exec/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-exec/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-exec/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-exec/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-exec/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-exec/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-exec/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-exec/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-exec/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-exec/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-exec/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-exec/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-exec/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-exec/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-exec/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-exec/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-exec/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-exec/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-exec/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-exec/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-exec/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-exec/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-exec/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-exec/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-bc4160a6a1ede4ee-hosts", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-a1372f1433b2d57a-termination-log", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-778950d1dc37ac62-hostname", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-856be8eac02b039b-resolv.conf", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/..2024_05_08_18_08_16.640162577", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/..2024_05_08_18_08_16.640162577/ca.crt", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/..2024_05_08_18_08_16.640162577/namespace", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/..2024_05_08_18_08_16.640162577/token", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/..data", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_08_16.640162577", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/ca.crt", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/namespace", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount/token", + "tests/kata/data/pod-exec/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-exec/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-exec/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-exec/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-exec/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-exec/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-exec/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-exec/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-exec/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-exec/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-exec/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-exec/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-exec/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-exec/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-exec/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"exec-test\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-exec/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b\", \"io.kubernetes.cri.sandbox-name\": \"exec-test\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"ada2ca20-1a14-42b4-ae7e-f1a45d63fa33\"}", + "tests/kata/data/pod-exec/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-exec/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-exec/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-exec/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-exec/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-exec/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-exec/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-exec/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-exec/policy.rego:149: allow_by_anno 2: i_s_name = exec-test p_s_name = exec-test", + "tests/kata/data/pod-exec/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-exec/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-exec/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-exec/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-exec/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-exec/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-exec/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-exec/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-exec/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-exec/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-exec/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-exec/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-exec/policy.rego:271: allow_container_annotation: p_value = busybox i_value = busybox", + "tests/kata/data/pod-exec/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-exec/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-exec/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-exec/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-exec/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-exec/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-exec/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-exec/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-exec/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-exec/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = aac41059addb88a5ae3ab458912d6ea167cdf3e055a7c6698b647bac4fdb5c8b regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-exec/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-exec/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-exec/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6", + "tests/kata/data/pod-exec/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-exec/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-exec/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-exec/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-exec/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-bc4160a6a1ede4ee-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-bc4160a6a1ede4ee-hosts", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-a1372f1433b2d57a-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-a1372f1433b2d57a-termination-log", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-778950d1dc37ac62-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-778950d1dc37ac62-hostname", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-856be8eac02b039b-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-856be8eac02b039b-resolv.conf", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-exec/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-exec/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-exec/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-exec/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6-b72adc8e24c572c5-serviceaccount", + "tests/kata/data/pod-exec/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-exec/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-exec/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-exec/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-exec/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-exec/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-exec/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-exec/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-exec/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-exec/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-exec/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-exec/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-exec/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-exec/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-exec/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-exec/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-exec/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-exec/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-exec/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-exec/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-exec/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-exec/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-exec/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-exec/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-exec/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-exec/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-exec/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-exec/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-exec/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-exec/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-exec/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-exec/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-exec/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-exec/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-exec/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-exec/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-exec/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-exec/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-exec/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-exec/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-exec/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-exec/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-exec/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-exec/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-exec/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-exec/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-exec/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-exec/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-exec/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-exec/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-exec/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-exec/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-exec/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-exec/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-exec/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-exec/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-exec/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-exec/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-exec/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-exec/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6", + "tests/kata/data/pod-exec/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-exec/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6", + "tests/kata/data/pod-exec/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-exec/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-exec/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-exec/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-exec/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-exec/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-exec/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-exec/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-exec/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-exec/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1056: allow_caps: policy Bounding = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-exec/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-exec/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-exec/policy.rego:1060: allow_caps: policy Effective = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-exec/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-exec/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-exec/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-exec/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1068: allow_caps: policy Permitted = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-exec/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-exec/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-exec/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-exec/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-exec/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-exec/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-exec/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-exec/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-exec/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo Kubernetes; sleep 10; done\"]", + "tests/kata/data/pod-exec/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo Kubernetes; sleep 10; done\"]", + "tests/kata/data/pod-exec/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-exec/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-exec/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-exec/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-exec/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-exec/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-exec/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-exec/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-exec/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-exec/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-exec/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-exec/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-exec/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo Kubernetes; sleep 10; done p_arg = while true; do echo Kubernetes; sleep 10; done", + "tests/kata/data/pod-exec/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-exec/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo Kubernetes; sleep 10; done p_arg = while true; do echo Kubernetes; sleep 10; done", + "tests/kata/data/pod-exec/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo Kubernetes; sleep 10; done p_arg = while true; do echo Kubernetes; sleep 10; done", + "tests/kata/data/pod-exec/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo Kubernetes; sleep 10; done", + "tests/kata/data/pod-exec/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-exec/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-exec/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"POD_NAME=$(sandbox-name)\", \"POD_NAMESPACE=default\", \"POD_IP=$(pod-ip)\", \"SERVICE_ACCOUNT=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=$(node-name)\"]", + "tests/kata/data/pod-exec/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"]", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = HOSTNAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = POD_IP=10.244.0.16", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:664: allow_pod_ip_var: true", + "tests/kata/data/pod-exec/policy.rego:602: allow_var 4: true", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAME=exec-test", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-exec/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-exec/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-exec/policy.rego:558: allow_env: true", + "tests/kata/data/pod-exec/policy.rego:478: allow_process: true", + "tests/kata/data/pod-exec/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-exec/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-exec/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-exec/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-exec/policy.rego:351: allow_masked_paths 1: p_paths = []", + "tests/kata/data/pod-exec/policy.rego:354: allow_masked_paths 1: i_paths = []", + "tests/kata/data/pod-exec/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-exec/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-exec/policy.rego:388: allow_readonly_paths 1: p_paths = []", + "tests/kata/data/pod-exec/policy.rego:391: allow_readonly_paths 1: i_paths = []", + "tests/kata/data/pod-exec/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-exec/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-exec/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-exec/policy.rego:85: CreateContainerRequest: true" + ], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"230a7dd5-f55e-40c2-b866-c98ad050c029\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_NODE_NAME} startup\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"230a7dd5-f55e-40c2-b866-c98ad050c029\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_NODE_NAME} startup\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"230a7dd5-f55e-40c2-b866-c98ad050c029\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_NODE_NAME} startup\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_NODE_NAME} startup" + ], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"52f23a0b-0f09-4673-9541-5636889b6ca7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"52f23a0b-0f09-4673-9541-5636889b6ca7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"52f23a0b-0f09-4673-9541-5636889b6ca7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f1d04442-303f-40cb-ac48-eff1f9406895\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f1d04442-303f-40cb-ac48-eff1f9406895\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f1d04442-303f-40cb-ac48-eff1f9406895\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bd33b367-2e42-4a83-8cf6-817eb10a1795\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bd33b367-2e42-4a83-8cf6-817eb10a1795\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bd33b367-2e42-4a83-8cf6-817eb10a1795\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"df812e16-cae6-46c4-b0fa-fdcc0e67472c\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"df812e16-cae6-46c4-b0fa-fdcc0e67472c\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"df812e16-cae6-46c4-b0fa-fdcc0e67472c\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"30724ed8-fff6-4b60-949d-e1380ace3706\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"30724ed8-fff6-4b60-949d-e1380ace3706\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"30724ed8-fff6-4b60-949d-e1380ace3706\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"91fdfbb6-07fa-4db6-b0be-c4a96f9a55f0\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"91fdfbb6-07fa-4db6-b0be-c4a96f9a55f0\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"91fdfbb6-07fa-4db6-b0be-c4a96f9a55f0\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"37faef9b-60ad-4b1d-a421-9481e3e4f155\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"37faef9b-60ad-4b1d-a421-9481e3e4f155\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"37faef9b-60ad-4b1d-a421-9481e3e4f155\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"45cce89a-2b14-4af8-a139-a24246b3def0\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"45cce89a-2b14-4af8-a139-a24246b3def0\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"45cce89a-2b14-4af8-a139-a24246b3def0\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"3e1adff3-61e4-467e-9b4c-f74e253287b3\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"3e1adff3-61e4-467e-9b4c-f74e253287b3\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"3e1adff3-61e4-467e-9b4c-f74e253287b3\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"1e3e1846-0136-4a05-aa7b-29601f7503f7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"1e3e1846-0136-4a05-aa7b-29601f7503f7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"1e3e1846-0136-4a05-aa7b-29601f7503f7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f8119a2e-06c8-4e6e-b94d-c7d360ae0c6e\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f8119a2e-06c8-4e6e-b94d-c7d360ae0c6e\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f8119a2e-06c8-4e6e-b94d-c7d360ae0c6e\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"4afec5b2-c29e-42f6-adbb-410b398dc377\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"4afec5b2-c29e-42f6-adbb-410b398dc377\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"4afec5b2-c29e-42f6-adbb-410b398dc377\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f6abfe03-0dca-41e8-b6a5-d4364c205005\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f6abfe03-0dca-41e8-b6a5-d4364c205005\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"f6abfe03-0dca-41e8-b6a5-d4364c205005\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"00945adb-7fa5-43b6-8dc0-b5d36378d1dc\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"00945adb-7fa5-43b6-8dc0-b5d36378d1dc\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"00945adb-7fa5-43b6-8dc0-b5d36378d1dc\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"301bb564-c4fd-484b-8c46-4044c051ba9f\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"301bb564-c4fd-484b-8c46-4044c051ba9f\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"301bb564-c4fd-484b-8c46-4044c051ba9f\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"28470f50-4f0c-4fca-a247-9634c70d5512\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"28470f50-4f0c-4fca-a247-9634c70d5512\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"28470f50-4f0c-4fca-a247-9634c70d5512\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bbe55000-3e78-43a4-963a-c762cde3a0e2\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bbe55000-3e78-43a4-963a-c762cde3a0e2\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bbe55000-3e78-43a4-963a-c762cde3a0e2\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"ac547fa2-97c2-4026-9e5a-5c1a51a2fdb1\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"ac547fa2-97c2-4026-9e5a-5c1a51a2fdb1\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"ac547fa2-97c2-4026-9e5a-5c1a51a2fdb1\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"de7ce829-d867-4ada-a8df-08de72c3fec2\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"de7ce829-d867-4ada-a8df-08de72c3fec2\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"de7ce829-d867-4ada-a8df-08de72c3fec2\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"a1b1e13c-d22f-41e6-857f-dd256f3f0d6a\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"a1b1e13c-d22f-41e6-857f-dd256f3f0d6a\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"a1b1e13c-d22f-41e6-857f-dd256f3f0d6a\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bfb9e571-b1dd-4217-b4a5-6d4d7c277332\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bfb9e571-b1dd-4217-b4a5-6d4d7c277332\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"bfb9e571-b1dd-4217-b4a5-6d4d7c277332\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"7829bfcf-0e79-4e1c-ab63-3e715f3551d7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"7829bfcf-0e79-4e1c-ab63-3e715f3551d7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"7829bfcf-0e79-4e1c-ab63-3e715f3551d7\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"56ccd0f4-1142-49a4-9732-146efca8e771\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"56ccd0f4-1142-49a4-9732-146efca8e771\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"56ccd0f4-1142-49a4-9732-146efca8e771\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [], + [], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"ebb9afb5-e802-491d-9a4c-a49e9c0e655b\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"ebb9afb5-e802-491d-9a4c-a49e9c0e655b\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"ebb9afb5-e802-491d-9a4c-a49e9c0e655b\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"${ISTIO_META_APP_CONTAINERS}\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo ${ISTIO_META_APP_CONTAINERS}" + ], + [ + "tests/kata/data/pod-exec/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"15ba4186-176e-4903-b8c9-672f676645ef\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1179: ExecProcessRequest 1: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"15ba4186-176e-4903-b8c9-672f676645ef\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1192: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_APP_CONTAINERS}", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo Ready ${POD_IP}!", + "tests/kata/data/pod-exec/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-exec/policy.rego:1196: ExecProcessRequest 2: p_command = echo ${ISTIO_META_NODE_NAME} startup", + "tests/kata/data/pod-exec/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"42cd455d88baf5b3d2a94fe7bdef82da5bcca78d6c2c62149724a952897bf5b6\", \"exec_id\": \"15ba4186-176e-4903-b8c9-672f676645ef\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"Ready ${POD_IP}!\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=exec-test\", \"POD_IP=10.244.0.16\", \"SERVICE_ACCOUNT=default\", \"POD_NAME=exec-test\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-exec/policy.rego:1207: ExecProcessRequest 3: i_command = echo Ready ${POD_IP}!" + ], + [], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-lifecycle/prints.json b/tests/kata/data/pod-lifecycle/prints.json new file mode 100644 index 0000000..0df6e78 --- /dev/null +++ b/tests/kata/data/pod-lifecycle/prints.json @@ -0,0 +1,1582 @@ +[ + [], + [], + [], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-lifecycle/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-lifecycle/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-lifecycle/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-lifecycle/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-lifecycle/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-lifecycle/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-lifecycle/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098-34d3b6116093e1e7-resolv.conf", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-lifecycle/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-lifecycle/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-lifecycle/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-lifecycle/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-lifecycle/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-lifecycle/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"pod-lifecycle\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-lifecycle/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_pod-lifecycle_078af1e8-328a-4f89-adfb-bae4455fbf50\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"pod-lifecycle\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"078af1e8-328a-4f89-adfb-bae4455fbf50\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-b894e817-0cf4-867e-21d1-af214f3a1a59\"}", + "tests/kata/data/pod-lifecycle/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:149: allow_by_anno 2: i_s_name = pod-lifecycle p_s_name = pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-lifecycle/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-lifecycle/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-lifecycle/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-lifecycle/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-lifecycle/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-lifecycle/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-lifecycle/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-lifecycle/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-lifecycle/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-lifecycle/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-lifecycle/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-b894e817-0cf4-867e-21d1-af214f3a1a59", + "tests/kata/data/pod-lifecycle/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-lifecycle/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-lifecycle/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_pod-lifecycle_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-lifecycle/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_pod-lifecycle_078af1e8-328a-4f89-adfb-bae4455fbf50", + "tests/kata/data/pod-lifecycle/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-lifecycle/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-lifecycle/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-lifecycle/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-lifecycle/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098 regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-lifecycle/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-lifecycle/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-lifecycle/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098", + "tests/kata/data/pod-lifecycle/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-lifecycle/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098-34d3b6116093e1e7-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098-34d3b6116093e1e7-resolv.conf", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-lifecycle/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-lifecycle/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-lifecycle/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-lifecycle/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-lifecycle/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-lifecycle/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-lifecycle/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-lifecycle/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-lifecycle/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-lifecycle/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-lifecycle/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-lifecycle/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-lifecycle/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-lifecycle/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-lifecycle/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-lifecycle/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-lifecycle/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-lifecycle/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-lifecycle/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-lifecycle/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-lifecycle/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-lifecycle/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-lifecycle/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-lifecycle/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098", + "tests/kata/data/pod-lifecycle/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098", + "tests/kata/data/pod-lifecycle/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-lifecycle/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-lifecycle/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-lifecycle/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-lifecycle/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-lifecycle/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-lifecycle/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-lifecycle/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-lifecycle/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/pod-lifecycle/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-lifecycle/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-lifecycle/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-lifecycle/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-lifecycle/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-lifecycle/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-lifecycle/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-lifecycle/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-lifecycle/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:558: allow_env: true", + "tests/kata/data/pod-lifecycle/policy.rego:478: allow_process: true", + "tests/kata/data/pod-lifecycle/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-lifecycle/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-lifecycle/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-lifecycle/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-lifecycle/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-lifecycle/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-lifecycle/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-lifecycle/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-lifecycle/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-lifecycle/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-lifecycle/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-lifecycle/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-lifecycle/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-lifecycle/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-lifecycle/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-lifecycle/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-lifecycle/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-lifecycle/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-lifecycle/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-lifecycle/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-lifecycle/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-lifecycle/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-lifecycle/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-a5e55412d673d067-hosts", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-036d9af44f466fd3-termination-log", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-be4bb8149b1a22d4-hostname", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-cbb967c03ec60c27-resolv.conf", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/..2024_05_08_18_12_07.1887069138", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/..2024_05_08_18_12_07.1887069138/ca.crt", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/..2024_05_08_18_12_07.1887069138/namespace", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/..2024_05_08_18_12_07.1887069138/token", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/..data", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_12_07.1887069138", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/ca.crt", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/namespace", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount/token", + "tests/kata/data/pod-lifecycle/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-lifecycle/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-lifecycle/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-lifecycle/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-lifecycle/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-lifecycle/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-lifecycle/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-lifecycle/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-lifecycle/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-lifecycle/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-lifecycle/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-lifecycle/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-lifecycle/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-lifecycle/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"pod-lifecycle\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-lifecycle/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098\", \"io.kubernetes.cri.sandbox-name\": \"pod-lifecycle\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"078af1e8-328a-4f89-adfb-bae4455fbf50\"}", + "tests/kata/data/pod-lifecycle/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-lifecycle/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-lifecycle/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-lifecycle/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:149: allow_by_anno 2: i_s_name = pod-lifecycle p_s_name = pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-lifecycle/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-lifecycle/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-lifecycle/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-lifecycle/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-lifecycle/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-lifecycle/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-lifecycle/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-lifecycle/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-lifecycle/policy.rego:271: allow_container_annotation: p_value = busybox i_value = busybox", + "tests/kata/data/pod-lifecycle/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-lifecycle/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-lifecycle/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-lifecycle/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-lifecycle/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-lifecycle/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-lifecycle/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-lifecycle/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-lifecycle/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = a3e5b029b23f8e3a63e5c231cf63688477a77f5036f249f722823eef73771098 regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-lifecycle/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-lifecycle/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-lifecycle/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67", + "tests/kata/data/pod-lifecycle/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-lifecycle/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-lifecycle/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-a5e55412d673d067-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-a5e55412d673d067-hosts", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-036d9af44f466fd3-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-036d9af44f466fd3-termination-log", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-be4bb8149b1a22d4-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-be4bb8149b1a22d4-hostname", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-cbb967c03ec60c27-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-cbb967c03ec60c27-resolv.conf", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-lifecycle/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-lifecycle/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-lifecycle/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67-5551049a2dcacf07-serviceaccount", + "tests/kata/data/pod-lifecycle/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-lifecycle/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-lifecycle/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-lifecycle/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-lifecycle/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-lifecycle/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-lifecycle/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-lifecycle/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-lifecycle/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-lifecycle/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-lifecycle/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-lifecycle/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-lifecycle/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-lifecycle/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-lifecycle/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-lifecycle/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-lifecycle/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-lifecycle/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-lifecycle/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-lifecycle/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-lifecycle/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-lifecycle/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-lifecycle/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-lifecycle/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-lifecycle/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-lifecycle/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-lifecycle/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-lifecycle/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-lifecycle/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-lifecycle/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-lifecycle/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-lifecycle/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-lifecycle/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-lifecycle/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-lifecycle/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-lifecycle/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-lifecycle/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-lifecycle/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-lifecycle/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-lifecycle/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-lifecycle/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-lifecycle/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-lifecycle/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-lifecycle/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-lifecycle/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-lifecycle/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-lifecycle/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67", + "tests/kata/data/pod-lifecycle/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67", + "tests/kata/data/pod-lifecycle/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-lifecycle/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-lifecycle/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-lifecycle/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-lifecycle/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-lifecycle/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-lifecycle/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-lifecycle/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1056: allow_caps: policy Bounding = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:1060: allow_caps: policy Effective = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-lifecycle/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1068: allow_caps: policy Permitted = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-lifecycle/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-lifecycle/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-lifecycle/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-lifecycle/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-lifecycle/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo $(sandbox-name); sleep 10; done\"]", + "tests/kata/data/pod-lifecycle/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo pod-lifecycle; sleep 10; done\"]", + "tests/kata/data/pod-lifecycle/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-lifecycle/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-lifecycle/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-lifecycle/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-lifecycle/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-lifecycle/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-lifecycle/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-lifecycle/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-lifecycle/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo pod-lifecycle; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/pod-lifecycle/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo pod-lifecycle; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/pod-lifecycle/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo pod-lifecycle; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/pod-lifecycle/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo pod-lifecycle; sleep 10; done", + "tests/kata/data/pod-lifecycle/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"POD_NAME=$(sandbox-name)\", \"POD_NAMESPACE=default\", \"POD_IP=$(pod-ip)\", \"SERVICE_ACCOUNT=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"ISTIO_META_NODE_NAME=$(node-name)\"]", + "tests/kata/data/pod-lifecycle/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=pod-lifecycle\", \"POD_NAME=pod-lifecycle\", \"POD_IP=10.244.0.17\", \"SERVICE_ACCOUNT=default\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\"]", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = HOSTNAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = POD_IP=10.244.0.17", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:664: allow_pod_ip_var: true", + "tests/kata/data/pod-lifecycle/policy.rego:602: allow_var 4: true", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAME=pod-lifecycle", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:573: allow_var 2: p_var2 = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-lifecycle/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = SERVICE_ACCOUNT=default", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PROXY_CONFIG={}\n", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_POD_PORTS=[\n]", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_APP_CONTAINERS=serviceaclient", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_CLUSTER_ID=Kubernetes", + "tests/kata/data/pod-lifecycle/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = ISTIO_META_NODE_NAME=$(node-name)", + "tests/kata/data/pod-lifecycle/policy.rego:558: allow_env: true", + "tests/kata/data/pod-lifecycle/policy.rego:478: allow_process: true", + "tests/kata/data/pod-lifecycle/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-lifecycle/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-lifecycle/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-lifecycle/policy.rego:351: allow_masked_paths 1: p_paths = []", + "tests/kata/data/pod-lifecycle/policy.rego:354: allow_masked_paths 1: i_paths = []", + "tests/kata/data/pod-lifecycle/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:388: allow_readonly_paths 1: p_paths = []", + "tests/kata/data/pod-lifecycle/policy.rego:391: allow_readonly_paths 1: i_paths = []", + "tests/kata/data/pod-lifecycle/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-lifecycle/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-lifecycle/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-lifecycle/policy.rego:85: CreateContainerRequest: true" + ], + [], + [ + "tests/kata/data/pod-lifecycle/policy.rego:1176: ExecProcessRequest 1: input = {\"container_id\": \"45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"exec_id\": \"9de547dd-0cad-42b6-a830-e00c297226bf\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"hello from postStart hook\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=pod-lifecycle\", \"POD_NAME=pod-lifecycle\", \"POD_IP=10.244.0.17\", \"SERVICE_ACCOUNT=default\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-lifecycle/policy.rego:1179: ExecProcessRequest 1: i_command = echo hello from postStart hook", + "tests/kata/data/pod-lifecycle/policy.rego:1188: ExecProcessRequest 2: input = {\"container_id\": \"45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"exec_id\": \"9de547dd-0cad-42b6-a830-e00c297226bf\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"hello from postStart hook\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=pod-lifecycle\", \"POD_NAME=pod-lifecycle\", \"POD_IP=10.244.0.17\", \"SERVICE_ACCOUNT=default\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-lifecycle/policy.rego:1192: ExecProcessRequest 3: i_command = echo hello from postStart hook", + "tests/kata/data/pod-lifecycle/policy.rego:1196: ExecProcessRequest 2: p_command = echo hello from postStart hook", + "tests/kata/data/pod-lifecycle/policy.rego:1201: ExecProcessRequest 2: true", + "tests/kata/data/pod-lifecycle/policy.rego:1204: ExecProcessRequest 3: input = {\"container_id\": \"45bd74c304beec46aa5a433009e3ab6703d7995c37154ebe6a0d859924ebdf67\", \"exec_id\": \"9de547dd-0cad-42b6-a830-e00c297226bf\", \"process\": {\"ApparmorProfile\": \"\", \"Args\": [\"echo\", \"hello from postStart hook\"], \"Capabilities\": null, \"ConsoleSize\": null, \"Cwd\": \"/\", \"Env\": [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=pod-lifecycle\", \"POD_NAME=pod-lifecycle\", \"POD_IP=10.244.0.17\", \"SERVICE_ACCOUNT=default\", \"ISTIO_META_CLUSTER_ID=Kubernetes\", \"POD_NAMESPACE=default\", \"PROXY_CONFIG={}\\n\", \"ISTIO_META_POD_PORTS=[\\n]\", \"ISTIO_META_APP_CONTAINERS=serviceaclient\", \"ISTIO_META_NODE_NAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\"], \"NoNewPrivileges\": false, \"OOMScoreAdj\": 0, \"Rlimits\": [], \"SelinuxLabel\": \"\", \"Terminal\": false, \"User\": {\"AdditionalGids\": [0, 10], \"GID\": 0, \"UID\": 0, \"Username\": \"\"}}, \"string_user\": null}", + "tests/kata/data/pod-lifecycle/policy.rego:1207: ExecProcessRequest 3: i_command = echo hello from postStart hook" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-many-layers/prints.json b/tests/kata/data/pod-many-layers/prints.json new file mode 100644 index 0000000..340f724 --- /dev/null +++ b/tests/kata/data/pod-many-layers/prints.json @@ -0,0 +1,8087 @@ +[ + [], + [], + [], + [ + "tests/kata/data/pod-many-layers/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-many-layers/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-many-layers/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-many-layers/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-many-layers/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-many-layers/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c-acad8bd86c53b0b2-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-many-layers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_many-layers_b78866ba-f3f0-4467-96f7-f610d8db99ac\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-9da1d64b-d15d-3b1c-754c-a06ce8c041f8\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-many-layers/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-many-layers/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-many-layers/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-many-layers/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-many-layers/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-9da1d64b-d15d-3b1c-754c-a06ce8c041f8", + "tests/kata/data/pod-many-layers/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-many-layers/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-many-layers/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_many-layers_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-many-layers/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_many-layers_b78866ba-f3f0-4467-96f7-f610d8db99ac", + "tests/kata/data/pod-many-layers/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-many-layers/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-many-layers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-many-layers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-many-layers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-many-layers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c", + "tests/kata/data/pod-many-layers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-many-layers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-many-layers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-many-layers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-many-layers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c-acad8bd86c53b0b2-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c-acad8bd86c53b0b2-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-many-layers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-many-layers/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-many-layers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-many-layers/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-many-layers/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-many-layers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-many-layers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-many-layers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-many-layers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c", + "tests/kata/data/pod-many-layers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-many-layers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-many-layers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-many-layers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-many-layers/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-many-layers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/pod-many-layers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-many-layers/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-many-layers/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-many-layers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-many-layers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-many-layers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-many-layers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-many-layers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-many-layers/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-many-layers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-5d9c73b7e4920e4c-hosts", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1dddb5cf284a6db2-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-913177b4b1944db2-hostname", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-d95ac830a537c69c-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/..2024_05_08_18_13_42.1553911240/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/..2024_05_08_18_13_42.1553911240/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/..2024_05_08_18_13_42.1553911240/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/..data", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-many-layers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = footloose i_value = footloose", + "tests/kata/data/pod-many-layers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-many-layers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-many-layers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-many-layers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-many-layers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-many-layers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-many-layers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-many-layers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-many-layers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-many-layers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-many-layers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06", + "tests/kata/data/pod-many-layers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-many-layers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-many-layers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-many-layers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-many-layers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-5d9c73b7e4920e4c-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-5d9c73b7e4920e4c-hosts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1dddb5cf284a6db2-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1dddb5cf284a6db2-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-913177b4b1944db2-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-913177b4b1944db2-hostname", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-d95ac830a537c69c-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-d95ac830a537c69c-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06-1e6d5fbe932eb31f-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:794: allow_storages: p_count = 12 i_count = 12", + "tests/kata/data/pod-many-layers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:805: allow_storages: layer_ids = [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"]", + "tests/kata/data/pod-many-layers/policy.rego:808: allow_storages: root_hashes = [\"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\", \"f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\", \"60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\", \"328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\", \"5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\", \"d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\", \"a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\", \"c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\", \"7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\", \"ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\", \"7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"]", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\"], \"source\": \"0001:00:08.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\"], \"source\": \"0001:00:09.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\"], \"source\": \"0001:00:0a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer9)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer9)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer9)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\"], \"source\": \"0001:00:0b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer10)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer10)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer10)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"0001:00:0c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\", \"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b:f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16:60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68:328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257:5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8:d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291:a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b:c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e:7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831:ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816:7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=\", \"io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=\", \"io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=\", \"io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=\", \"io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=\", \"io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=\", \"io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=\", \"io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=\", \"io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=\", \"io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=\", \"io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:850: allow_storage_options 2: policy_ids = [\"6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157\", \"0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834\", \"6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537\", \"fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c\", \"53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de\", \"c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575\", \"888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963\", \"c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a\", \"544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15\", \"282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe\", \"a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e\"]", + "tests/kata/data/pod-many-layers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b\", \"f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16\", \"60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68\", \"328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257\", \"5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8\", \"d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291\", \"a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b\", \"c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e\", \"7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831\", \"ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816\", \"7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a\"]", + "tests/kata/data/pod-many-layers/policy.rego:857: allow_storage_options 2: p_count = 11", + "tests/kata/data/pod-many-layers/policy.rego:862: allow_storage_options 2: i_count = 14", + "tests/kata/data/pod-many-layers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-many-layers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-many-layers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e", + "tests/kata/data/pod-many-layers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157:0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834:6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537:fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c:53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de:c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575:888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963:c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a:544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15:282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe:a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157 policy_hash = 942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NmY4ZWQyOTYwZGY2ODhiOTBkNDE1ZDgzZDI1ZGIyYTc4OThmNzk1MjgyZmIyZDM1YmExZjFiN2QwODkyZDE1Nyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk0MmI0NDRjZTE3MjhhYzBlYjUxNWU3YjAwMjZkMDZmMzEwNmIxZjYwMWZmZGE2NjJlMjFkMTJhYmRmMTgzM2I=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 6f8ed2960df688b90d415d83d25db2a7898f795282fb2d35ba1f1b7d0892d157,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=942b444ce1728ac0eb515e7b0026d06f3106b1f601ffda662e21d12abdf1833b", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834 policy_hash = f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MGUzOTM4ZGE2NDdhMTg0NzhiZTBjMmY4ODZhYmEwMDU3MGUwYTVkMDcxZjlkNzk3ZGYzOGQ3OTA5ZWM2NDgzNCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY5NzZkMDAzNTlkMTRlNjBhMTMzODBlYTg2M2E0ZWExNWJhMWE4YmM2NzNhZDFjNzFmN2QxNzA2MGY4ZjdkMTY=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 0e3938da647a18478be0c2f886aba00570e0a5d071f9d797df38d7909ec64834,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=f976d00359d14e60a13380ea863a4ea15ba1a8bc673ad1c71f7d17060f8f7d16", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537 policy_hash = 60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NmIzODdmZTU5OTVhNGM1ZTQyMDdjNGRmMTkzNjVkZTM0N2UwM2I2YzllZWMzZTlhMDRhM2RkMThlMTliNTUzNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYwZDA3ZTViZWIxNmM2ODMwYTdhZGQ3YzY1ZDRkYzMyZjAwMWM4NjU5NjliOTJiNGI2YzI3MGRjM2Y4N2ZhNjg=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 6b387fe5995a4c5e4207c4df19365de347e03b6c9eec3e9a04a3dd18e19b5537,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=60d07e5beb16c6830a7add7c65d4dc32f001c865969b92b4b6c270dc3f87fa68", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c policy_hash = 328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ZmIxN2JmNjIyMDQwNDliMmRmYzAzNDRlNDc1ZjhlMWExZjUwYTc1MWI1ZmJhY2JkNzVhMjRhZmFjMzQ1ZDYzYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTMyOGExZGZhOTBkM2UwMmQ2MzczMzMwMDVhNTdkYWIyMzk4NGEwMDA3YmZlZGM0YmEwZDg0YWNmODE4MzMyNTc=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = fb17bf62204049b2dfc0344e475f8e1a1f50a751b5fbacbd75a24afac345d63c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=328a1dfa90d3e02d637333005a57dab23984a0007bfedc4ba0d84acf81833257", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de policy_hash = 5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NTM1MzRmNmY5MTJhYTU0OTU0YjU5NGZiNTg1YTgyOTc1OGEyMzU4OGFlZjUzYTM2YjkyYWQzN2Q0M2M4NjZkZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVlNjVlMzNjZTE0NTUwOWE3MjM4YTIzZDZhYzZiMTcxMDViMjcyZjFmYjAzOTY0ODJjYjNmYTAyZWMyYjI1Yzg=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 53534f6f912aa54954b594fb585a829758a23588aef53a36b92ad37d43c866de,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=5e65e33ce145509a7238a23d6ac6b17105b272f1fb0396482cb3fa02ec2b25c8", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575 policy_hash = d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YzI2ODJhMDllODNkNjE4NmJmYmJmMDE0MjkyNzI3NGI0OTA1NzgxNWI2OWQ4NmVjNGE4ZDM0Mjg3MjBmODU3NSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQ3NTNjZjZhZjJiN2VlZmYzZTQxYjMwN2NiNTBkNGE3YzdmNjAwMmZiNzdiNmYxNjVlMDEwZDdiZDVmOTYyOTE=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = c2682a09e83d6186bfbbf0142927274b49057815b69d86ec4a8d3428720f8575,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d753cf6af2b7eeff3e41b307cb50d4a7c7f6002fb77b6f165e010d7bd5f96291", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963 policy_hash = a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ODg4MDU2ZDgwMzY5MmNiNjYyYzlhMGI4NWJhOTA5NDJlNTI0NjdiNjE0ZDc2MzQwZjU1YmM5ZDgxNmUxOTk2Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEyNWVkN2QxYWE3YTY4MmZhYjdmMjExNmM4NmE0M2RjMGMwOWNkZTYyNmE0ZTQ3YjM3NDI4MzEwNmM5YWUwNmI=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 888056d803692cb662c9a0b85ba90942e52467b614d76340f55bc9d816e19963,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=a25ed7d1aa7a682fab7f2116c86a43dc0c09cde626a4e47b374283106c9ae06b", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a policy_hash = c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YzYxYzc5ZjUzMTlkZGJjMzRmOGNmNmU5M2MyNDZiYWRhZTExNDk4ZTVlNjM2MjgzOTc0MjNkZDE0Y2Q2NDAwYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWMwZDc2NjZmMTEzZTM5YTRjN2JmZDk4MDg2ZmUxODlkN2UzZTk1ZDQ3ZTZlNGQ2MmQ2NWVmY2FmN2RjYTA5OWU=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = c61c79f5319ddbc34f8cf6e93c246badae11498e5e63628397423dd14cd6400a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=c0d7666f113e39a4c7bfd98086fe189d7e3e95d47e6e4d62d65efcaf7dca099e", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15 policy_hash = 7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NTQ0Y2Q0NmRkZWFlZGY3YmVmZmE5MWFlMTAyNDE4YzA0NDczZDhjZjc5YWQ1MjI3MzQ2MzA5NDM1NGQ5YmQxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkNGQ5MzJjYjM2YjU0ZmVlNzk0YjgzOTdhOTQwZjgxZmQyMzVkYTI4YmMxNTMzOTc1ODQ1ZmQ4MTFmMWU4MzE=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 544cd46ddeaedf7beffa91ae102418c04473d8cf79ad52273463094354d9bd15,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7d4d932cb36b54fee794b8397a940f81fd235da28bc1533975845fd811f1e831", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe policy_hash = ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjgyNjI2ZDVhNDE3YzYwODIwZjQyOWU2ZDRkNzdkYzdmZTNhNTFkMmY0YjE4NTFmYjAzNzgyMWFkMWViYWVmZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWZmMWM4MWEwMDIxNGFlNTIwODMzZGJiM2JmZDVjZWFhMWUxNGYyOWM2MmZlNjk5NjY4ZGZhNDBmYmY2YzI4MTY=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 282626d5a417c60820f429e6d4d77dc7fe3a51d2f4b1851fb037821ad1ebaefe,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ff1c81a00214ae520833dbb3bfd5ceaa1e14f29c62fe699668dfa40fbf6c2816", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e policy_hash = 7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YTZlMWVmZmVkNDVjYjNjNzA3NDQ1Y2RkZGQwNTMzNWIwNTBmMWYzZmNmNjE2OWUwNTdmMTJiMDdiNGRiNjY2ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdkMDQzODI2ODVkZTNmMjdjN2Q5ZGI2NzhhMDIzZGI2YTNiNDM3N2U0ZjdlZmQ5ZTVjYmRlODU2ZjQ2YjE1NGE=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = a6e1effed45cb3c707445cdddd05335b050f1f3fcf6169e057f12b07b4db666e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7d04382685de3f27c7d9db678a023db6a3b4377e4f7efd9e5cbde856f46b154a", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06", + "tests/kata/data/pod-many-layers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-many-layers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-many-layers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-many-layers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-many-layers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-many-layers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-many-layers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-many-layers/policy.rego:507: allow_args 2: policy args = [\"sh\", \"-c\", \"while true; do echo go; sleep 25; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:508: allow_args 2: input args = [\"sh\", \"-c\", \"while true; do echo go; sleep 25; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = sh", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo go; sleep 25; done p_arg = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo go; sleep 25; done p_arg = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo go; sleep 25; done p_arg = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-many-layers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"container=docker\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-many-layers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=many-layers\", \"container=docker\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\"]", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = HOSTNAME=many-layers", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-many-layers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-many-layers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-many-layers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-many-layers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = bootloose i_value = footloose", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = nginx i_value = footloose", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/3e18310a4ef5b67a048cd90c7a3e861095925bf9cdd9c9ebea8dfe9a14869d06\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = python i_value = footloose" + ], + [], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-9545c8989f6ccd98-hosts", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-43980df2a7037297-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-7e342cc195c117f3-hostname", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-364919e659613c20-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/..2024_05_08_18_13_42.1553911240/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/..2024_05_08_18_13_42.1553911240/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/..2024_05_08_18_13_42.1553911240/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/..data", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-many-layers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = footloose i_value = nginx", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = bootloose i_value = nginx", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = nginx i_value = nginx", + "tests/kata/data/pod-many-layers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-many-layers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-many-layers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-many-layers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-many-layers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-many-layers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-many-layers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-many-layers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-many-layers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-many-layers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-many-layers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca", + "tests/kata/data/pod-many-layers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-many-layers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-many-layers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-many-layers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-many-layers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-9545c8989f6ccd98-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-9545c8989f6ccd98-hosts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-43980df2a7037297-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-43980df2a7037297-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-7e342cc195c117f3-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-7e342cc195c117f3-hostname", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-364919e659613c20-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-364919e659613c20-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca-1c83938b1e8fafba-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:794: allow_storages: p_count = 7 i_count = 7", + "tests/kata/data/pod-many-layers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:805: allow_storages: layer_ids = [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"]", + "tests/kata/data/pod-many-layers/policy.rego:808: allow_storages: root_hashes = [\"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\", \"ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\", \"d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\", \"1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\", \"1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\", \"e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"]", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:0d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:0e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:0f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:10.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:11.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:12.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:850: allow_storage_options 2: policy_ids = [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"]", + "tests/kata/data/pod-many-layers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\", \"ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\", \"d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\", \"1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\", \"1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\", \"e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"]", + "tests/kata/data/pod-many-layers/policy.rego:857: allow_storage_options 2: p_count = 6", + "tests/kata/data/pod-many-layers/policy.rego:862: allow_storage_options 2: i_count = 9", + "tests/kata/data/pod-many-layers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-many-layers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-many-layers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/pod-many-layers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2 policy_hash = 073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc policy_hash = ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983 policy_hash = d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c policy_hash = 1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7 policy_hash = 1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a policy_hash = e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca", + "tests/kata/data/pod-many-layers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-many-layers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-many-layers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-many-layers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-many-layers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-many-layers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-many-layers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-many-layers/policy.rego:507: allow_args 2: policy args = [\"sh\", \"-c\", \"while true; do echo nginx; sleep 10; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:508: allow_args 2: input args = [\"sh\", \"-c\", \"while true; do echo nginx; sleep 10; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = sh", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo nginx; sleep 10; done p_arg = while true; do echo nginx; sleep 10; done", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo nginx; sleep 10; done p_arg = while true; do echo nginx; sleep 10; done", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo nginx; sleep 10; done p_arg = while true; do echo nginx; sleep 10; done", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo nginx; sleep 10; done", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-many-layers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-many-layers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=many-layers\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\"]", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = HOSTNAME=many-layers", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-many-layers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-many-layers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-many-layers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-many-layers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/b2857301a288aebb2752aa2dacdaa6c65fd2531f0b311cace466c4d6f5a687ca\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = python i_value = nginx" + ], + [], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-4fbfa3bedd17c360-hosts", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-8393af5f1c95b571-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-918ad672fd418a9b-hostname", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-ec4bd254a1be53b9-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/..2024_05_08_18_13_42.1553911240/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/..2024_05_08_18_13_42.1553911240/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/..2024_05_08_18_13_42.1553911240/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/..data", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-many-layers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = footloose i_value = python", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = bootloose i_value = python", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = nginx i_value = python", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = python i_value = python", + "tests/kata/data/pod-many-layers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-many-layers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-many-layers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-many-layers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-many-layers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-many-layers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-many-layers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-many-layers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-many-layers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-many-layers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-many-layers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e", + "tests/kata/data/pod-many-layers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-many-layers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-many-layers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-many-layers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-many-layers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-4fbfa3bedd17c360-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-4fbfa3bedd17c360-hosts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-8393af5f1c95b571-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-8393af5f1c95b571-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-918ad672fd418a9b-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-918ad672fd418a9b-hostname", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-ec4bd254a1be53b9-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-ec4bd254a1be53b9-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e-0d5b5ffc09269c9c-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:794: allow_storages: p_count = 12 i_count = 12", + "tests/kata/data/pod-many-layers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:805: allow_storages: layer_ids = [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"]", + "tests/kata/data/pod-many-layers/policy.rego:808: allow_storages: root_hashes = [\"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\", \"b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\", \"e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\", \"7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\", \"c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\", \"f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\", \"7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\", \"f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\", \"8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\", \"6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\", \"629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"]", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\"], \"source\": \"0001:00:13.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\"], \"source\": \"0001:00:14.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\"], \"source\": \"0001:00:15.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\"], \"source\": \"0001:00:16.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\"], \"source\": \"0001:00:17.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\"], \"source\": \"0001:00:18.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\"], \"source\": \"0001:00:19.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\"], \"source\": \"0001:00:1a.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\"], \"source\": \"0001:00:1b.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer9)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer9)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer9)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\"], \"source\": \"0001:00:1c.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 9", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 10", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer10)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer10)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer10)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"0001:00:1d.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer9)\", \"options\": [\"$(hash9)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer10)\", \"options\": [\"$(hash10)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\", \"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae:b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822:e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d:7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98:c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd:f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5:7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0:f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3:8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf:6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904:629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=\", \"io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=\", \"io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=\", \"io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=\", \"io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=\", \"io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=\", \"io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=\", \"io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=\", \"io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=\", \"io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=\", \"io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:850: allow_storage_options 2: policy_ids = [\"0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56\", \"fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6\", \"cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5\", \"3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef\", \"a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12\", \"0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a\", \"0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815\", \"ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764\", \"d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e\", \"38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef\", \"329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01\"]", + "tests/kata/data/pod-many-layers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae\", \"b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822\", \"e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d\", \"7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98\", \"c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd\", \"f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5\", \"7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0\", \"f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3\", \"8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf\", \"6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904\", \"629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20\"]", + "tests/kata/data/pod-many-layers/policy.rego:857: allow_storage_options 2: p_count = 11", + "tests/kata/data/pod-many-layers/policy.rego:862: allow_storage_options 2: i_count = 14", + "tests/kata/data/pod-many-layers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-many-layers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-many-layers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01", + "tests/kata/data/pod-many-layers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56:fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6:cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5:3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef:a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12:0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a:0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815:ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764:d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e:38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef:329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56 policy_hash = b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MGRkOThlM2U2ZGVkOGQwYmU0MGQzNzZmN2E3YzAxY2I3NzkyYzZjOGVmODc4ZWU5NDc3YTZmOGZiOWRkZmE1Nix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIyOWJhNzMwMmQ3ZmM4YWIxNTM5ZWEyODA2MmU1NzkzOTU1Y2RjNTlmNzM1Mjk0MjkyOGQ0YzdhYjMzZTUyYWU=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 0dd98e3e6ded8d0be40d376f7a7c01cb7792c6c8ef878ee9477a6f8fb9ddfa56,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b29ba7302d7fc8ab1539ea28062e5793955cdc59f7352942928d4c7ab33e52ae", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6 policy_hash = b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ZmFjMGI1MDZiNzcxNzZjYjI4NWVhYWRjMzNhMmVhNjI3NDM5MzIyN2IxMTdiOWI5YTYzMDhhMGJhN2U4ZGJhNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI0YTc5NjM3MjdhYTk2MDI0ZGM1YzViM2YyOGI2NjgwM2Y0NjI2ZjY1MDZiNThlZTlmZDQ5ZmYxMDhhYWI4MjI=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = fac0b506b77176cb285eaadc33a2ea6274393227b117b9b9a6308a0ba7e8dba6,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b4a7963727aa96024dc5c5b3f28b66803f4626f6506b58ee9fd49ff108aab822", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5 policy_hash = e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=Y2RjOGI4ODkxMDdkNzFjNzZkNmExOWU4YTE0ZTllZjc0NzRhZDJiOGU5MmZlY2U0ZTFiNDVkNzE1OTU5OTViNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU3Mzg3ZjgzNzI2YjI5ZjUyZWY0NjNmNTc0NDIyMmJhMDVlMmQ0Nzk5NzQ0Nzg1ODc2NGU1M2E4NjRhNjc2NGQ=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = cdc8b889107d71c76d6a19e8a14e9ef7474ad2b8e92fece4e1b45d71595995b5,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e7387f83726b29f52ef463f5744222ba05e2d47997447858764e53a864a6764d", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef policy_hash = 7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=Mzk2MWQ0MGUxMTQ3M2Q4YzVmOTNhY2I0Zjc1ODUzYmUwZTk5Y2RlMzMxYTBmNWU5NzZmZjJiNDJmOWZkYWNlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdhODBlNzFkNmQ5MGE1MGRkZjhlOWY5OTE0MTY4NmU0NjA5ZjBiNDc1NTBlZjc0ZmYzNTM2MjRkMjY0MmRiOTg=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 3961d40e11473d8c5f93acb4f75853be0e99cde331a0f5e976ff2b42f9fdacef,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7a80e71d6d90a50ddf8e9f99141686e4609f0b47550ef74ff353624d2642db98", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12 policy_hash = c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YTkzMGU2YTNiYWQxZTNjNDI3M2VmYWNmZWJlMTA5ZWRlNmY5NTE4M2QwMGFkMDcyMDM5NTRmOWMxYTgyZWUxMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWM4ZGI2ZDNmZDNhYWE4ZjlkMGNlNWNhOGM3MWY1ZTM4N2UxN2YxYTZhNjQzZjVmZWQ5YTRjYWUxMjIzZDIxY2Q=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = a930e6a3bad1e3c4273efacfebe109ede6f95183d00ad07203954f9c1a82ee12,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=c8db6d3fd3aaa8f9d0ce5ca8c71f5e387e17f1a6a643f5fed9a4cae1223d21cd", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a policy_hash = f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MGZkN2E0YmQxYzJlZGM3YTU0M2FiM2ZlNWUyMGFiYWVlYTZiOGE0ZTQxNjE1YTIxYzRkNDFiNzc1NTM4Nzk5YSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWYzMjY0YzNiN2I5YThmNTE2MmU3NWVmYjE2YzU1ZWE0YjgzNTdmN2Y2NGFkOWY5YWZhYWNkYmYyYTQ3ZjM1YTU=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 0fd7a4bd1c2edc7a543ab3fe5e20abaeea6b8a4e41615a21c4d41b775538799a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=f3264c3b7b9a8f5162e75efb16c55ea4b8357f7f64ad9f9afaacdbf2a47f35a5", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815 policy_hash = 7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MGZlNzNjN2RmZTg0YmM5MzFiYjdhOTYzMTM5MjY0ZmFlNmRkNmZlNTE1YmU3N2U4MzlkNzEzZGM3YTA0NzgxNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTdmNjVmMGIxNzg3OGMzNTUxYThjOTNmMjc2YWI0ODc3MTQxYjRlZjQxZGRjM2QyZTJiMWFjNjJiNDI0NDg4ZDA=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 0fe73c7dfe84bc931bb7a963139264fae6dd6fe515be77e839d713dc7a047815,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=7f65f0b17878c3551a8c93f276ab4877141b4ef41ddc3d2e2b1ac62b424488d0", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764 policy_hash = f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YWU2ZTc4OTQ2ZmI2NGQ0MjA5YTY3Y2YwODEwNzlhYWE3MDBlZGJmOTFmYTUwNWYwZjQzNTM1ZDRkZmQyNDc2NCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWY1ZGRhNTA4NGIyMGZhYTAzNjlkYjU0YTllODk2OTNjYjZiN2U5ODk3OWJiNjZmYzViM2E4NTFjZmJiZGYwZTM=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = ae6e78946fb64d4209a67cf081079aaa700edbf91fa505f0f43535d4dfd24764,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=f5dda5084b20faa0369db54a9e89693cb6b7e98979bb66fc5b3a851cfbbdf0e3", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e policy_hash = 8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ZDAyYzNkNzcxYzdmYzZhNmIyYTkyMTU5YjliZDMyZTZkYTBjOWMxMzk4M2EwMTAxODQwMGFjYzkwZmMzMTY5ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPThlZGJhMTI4M2U2MTRkNmJkYzhkMzkxOThhYjI5YjhjNjI0Yjk1ZDhlY2QzZTgxMWFmYmZmYjQwYmM4NzM3Y2Y=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = d02c3d771c7fc6a6b2a92159b9bd32e6da0c9c13983a01018400acc90fc3169e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8edba1283e614d6bdc8d39198ab29b8c624b95d8ecd3e811afbffb40bc8737cf", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef policy_hash = 6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MzgzNzliODU2NWUwZTNjYjFkZDIzZjM3N2M4MzIyNmJkZTdmN2VhNjcxYzczYWNkOGYxOGYyYjAwNzg4YjVlZix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTZhZWE1YjNkZGZhYjgyMTAzMTUwMGM1ZTI4OTQ5MTI4ZjAyZGQ3MDU2ZTA5NzM0N2Q4ZGZjNDI4NjkxMDA5MDQ=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 38379b8565e0e3cb1dd23f377c83226bde7f7ea671c73acd8f18f2b00788b5ef,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=6aea5b3ddfab821031500c5e28949128f02dd7056e097347d8dfc42869100904", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01 policy_hash = 629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MzI5NDY0MzI3Zjk3YTdkYTU3MmU2MDlhYTAwZWQ5ODhiNWViZmZjMTUzN2Y4YjhhMGUzMzBkMzZmMDU1ZGYwMSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTYyOTY3MGQ5YmIxZTAwZTYyZDkyYmRkYjFhZTIwNjA0OGNjMmRlMjM0MTljMGY4N2UzZjk3NjIyYjliMGRiMjA=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 329464327f97a7da572e609aa00ed988b5ebffc1537f8b8a0e330d36f055df01,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=629670d9bb1e00e62d92bddb1ae206048cc2de23419c0f87e3f97622b9b0db20", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e", + "tests/kata/data/pod-many-layers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/2ff1a73620295ecb586fbb55029b25f85440cbdd937aadc20beb6cb48418a45e", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-many-layers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-many-layers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-many-layers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-many-layers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-many-layers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-many-layers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-many-layers/policy.rego:507: allow_args 2: policy args = [\"sh\", \"-c\", \"while true; do echo python; sleep 15; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:508: allow_args 2: input args = [\"sh\", \"-c\", \"while true; do echo python; sleep 15; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = sh", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo python; sleep 15; done p_arg = while true; do echo python; sleep 15; done", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo python; sleep 15; done p_arg = while true; do echo python; sleep 15; done", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo python; sleep 15; done p_arg = while true; do echo python; sleep 15; done", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo python; sleep 15; done", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-many-layers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"DEBIAN_FRONTEND=noninteractive\", \"LANG=en_US.UTF-8\", \"LANGUAGE=en_US:UTF-8\", \"LC_ALL=en_US.UTF-8\", \"PYTHON_MAJOR=3.3\", \"PYTHON_VERSION=3.3.6-4+xenial1\", \"PYTHONIOENCODING=UTF-8\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-many-layers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=many-layers\", \"DEBIAN_FRONTEND=noninteractive\", \"LANG=en_US.UTF-8\", \"LANGUAGE=en_US:UTF-8\", \"LC_ALL=en_US.UTF-8\", \"PYTHON_MAJOR=3.3\", \"PYTHON_VERSION=3.3.6-4+xenial1\", \"PYTHONIOENCODING=UTF-8\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\"]", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = HOSTNAME=many-layers", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = DEBIAN_FRONTEND=noninteractive", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANG=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LANGUAGE=en_US:UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = LC_ALL=en_US.UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_MAJOR=3.3", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHON_VERSION=3.3.6-4+xenial1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PYTHONIOENCODING=UTF-8", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-many-layers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-many-layers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-many-layers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-many-layers/policy.rego:85: CreateContainerRequest: true" + ], + [], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-f1ef6ff5e00f5f46-hosts", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-42168aa2791e3167-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-81134ec3739ec4f4-hostname", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-f71598673c8f16d8-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/..2024_05_08_18_13_42.1553911240/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/..2024_05_08_18_13_42.1553911240/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/..2024_05_08_18_13_42.1553911240/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/..data", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_13_42.1553911240", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount/token", + "tests/kata/data/pod-many-layers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-many-layers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-many-layers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-many-layers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-many-layers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"footloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/footloose/ubuntu18.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = footloose i_value = bootloose", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = bootloose i_value = bootloose", + "tests/kata/data/pod-many-layers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-many-layers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-many-layers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-many-layers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-many-layers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-many-layers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-many-layers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-many-layers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-many-layers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-many-layers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-many-layers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-many-layers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100", + "tests/kata/data/pod-many-layers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-many-layers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-many-layers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-many-layers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-many-layers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-f1ef6ff5e00f5f46-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-f1ef6ff5e00f5f46-hosts", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-42168aa2791e3167-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-42168aa2791e3167-termination-log", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-81134ec3739ec4f4-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-81134ec3739ec4f4-hostname", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-f71598673c8f16d8-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-f71598673c8f16d8-resolv.conf", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-many-layers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-many-layers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100-05e1290560832a13-serviceaccount", + "tests/kata/data/pod-many-layers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-many-layers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-many-layers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-many-layers/policy.rego:794: allow_storages: p_count = 10 i_count = 10", + "tests/kata/data/pod-many-layers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:805: allow_storages: layer_ids = [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"]", + "tests/kata/data/pod-many-layers/policy.rego:808: allow_storages: root_hashes = [\"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\", \"ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\", \"5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\", \"b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\", \"95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\", \"b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\", \"a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\", \"b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\", \"baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"]", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\"], \"source\": \"0001:00:1e.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\"], \"source\": \"0001:00:1f.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer2)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\"], \"source\": \"0002:00:01.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer3)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\"], \"source\": \"0002:00:02.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer4)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\"], \"source\": \"0002:00:03.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer5)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\"], \"source\": \"0002:00:04.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer6)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\"], \"source\": \"0002:00:05.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer7)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\"], \"source\": \"0002:00:06.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 6", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 7", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:895: allow_storage_options 3: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:955: allow_mount_point 1: i = 8", + "tests/kata/data/pod-many-layers/policy.rego:958: allow_mount_point 1: layer_id = 52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8", + "tests/kata/data/pod-many-layers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8", + "tests/kata/data/pod-many-layers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer8)", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"0002:00:07.0\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer6)\", \"options\": [\"$(hash6)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer7)\", \"options\": [\"$(hash7)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer8)\", \"options\": [\"$(hash8)\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\", \"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e:ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067:5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3:b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c:95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e:b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b:a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999:b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b:baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"], \"source\": \"\"}", + "tests/kata/data/pod-many-layers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=\", \"io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=\", \"io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=\", \"io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=\", \"io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=\", \"io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=\", \"io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=\", \"io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=\", \"io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"], \"source\": \"none\"}", + "tests/kata/data/pod-many-layers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-many-layers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-many-layers/policy.rego:850: allow_storage_options 2: policy_ids = [\"aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c\", \"97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950\", \"6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6\", \"4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5\", \"a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127\", \"75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e\", \"5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8\", \"b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e\", \"52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8\"]", + "tests/kata/data/pod-many-layers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e\", \"ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067\", \"5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3\", \"b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c\", \"95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e\", \"b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b\", \"a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999\", \"b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b\", \"baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046\"]", + "tests/kata/data/pod-many-layers/policy.rego:857: allow_storage_options 2: p_count = 9", + "tests/kata/data/pod-many-layers/policy.rego:862: allow_storage_options 2: i_count = 12", + "tests/kata/data/pod-many-layers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-many-layers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-many-layers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8", + "tests/kata/data/pod-many-layers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c:97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950:6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6:4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5:a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127:75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e:5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8:b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e:52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c policy_hash = 95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YWE4NDQzZTFlNGJlMDg5NGY5OTZjYWMwM2Y4ZTlhZjU5Y2JlNjU0NmYxYmEzNGFlNGNlYzdhZDE0NTc2NGE3Yyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1YTYyYjQxMDQ5MjZkNjA1MTA2ZDQ1Mjk3ZDU0ZWZlZmJjMGFlYmM3YjFlOTU4ZDZmYjM0Y2Q5MDZhODQ4MGU=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = aa8443e1e4be0894f996cac03f8e9af59cbe6546f1ba34ae4cec7ad145764a7c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=95a62b4104926d605106d45297d54efefbc0aebc7b1e958d6fb34cd906a8480e", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950 policy_hash = ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=OTdkNzYxMWY3MTU0ZjEzNTJmNmNiZmU4YThkMDRjODdiMGEyNzc3YTNiMTljY2Q4NDNhNjA3YzY2MjA3ODk1MCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWFiMDgxMTE1ZDg4OTY2ZWM3ZTBkOTViNDFmMmVmZTY4YjA3MmEwYTQzNGM2NDcwMWVjZTA4ODAyNmJiNTYwNjc=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 97d7611f7154f1352f6cbfe8a8d04c87b0a2777a3b19ccd843a607c662078950,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ab081115d88966ec7e0d95b41f2efe68b072a0a434c64701ece088026bb56067", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6 policy_hash = 5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NmQzZDA1MDM3OGQyNWFhZmM3MDljYjQyNGE5Y2MzZWI3OTg3YzMyZDhkY2M0YTlkZTZlMTMyZTQwYWY2ZThkNix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTVkZWZhNmJlMzViZDE4M2E1ZTE4MTVhZTYyMWVjYzcyZmFhZTliMDU2MzEwYTkzZGJkNGRmMjc3NmI3ZDMxZDM=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 6d3d050378d25aafc709cb424a9cc3eb7987c32d8dcc4a9de6e132e40af6e8d6,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=5defa6be35bd183a5e1815ae621ecc72faae9b056310a93dbd4df2776b7d31d3", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5 policy_hash = b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NGZlYmFmODI4ZWYzNmIzODI3MjNiNjBiNzhkYzVlNjdkZjk3ZTk4NWZkNjYwMjAxOTg1NTlhNGY2ODY3M2VmNSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIwYWFkNGVjM2UzYTdkNmVkNmYzMmQyNDg0NWQ5MmJjNTkwZjI5ZTIyZjIzZTc1YmM1MDk1MDQ3OTFjNzUxMWM=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 4febaf828ef36b382723b60b78dc5e67df97e985fd66020198559a4f68673ef5,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b0aad4ec3e3a7d6ed6f32d24845d92bc590f29e22f23e75bc509504791c7511c", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127 policy_hash = 95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YTI4MDdjMDE1ZWIwOGMxMTJjMmIwMDA2MTJmNGVhYjk4NGM5OWJiZDBiNWE0Y2UzOTViNDAxMjJjNzJjMDEyNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTk1Y2Y5YjQwZTM2NDlhMmZjMjZlODNiMjk4YWQ2NTFlNDk1ODdlOGQzNDMyNzg3ODEyYjUwYzkxNjUzNmI0MWU=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = a2807c015eb08c112c2b000612f4eab984c99bbd0b5a4ce395b40122c72c0127,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=95cf9b40e3649a2fc26e83b298ad651e49587e8d3432787812b50c916536b41e", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e policy_hash = b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NzUwNzFjM2ExMTNjZWMyNDEzNmU4NDdjMWUzZjBjMmRhOGQ0NGE1ZGQ3N2EzNzZkNDIxZjcyNWI5MWIzOWMzZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI1MTc4ZGNlOTE5MTRiOGZmNTViMTA5ZTJiMzlkNmVjYTZjYTMzMmIxYzkyMWUwODZlMWE1Y2EwNmU3MDE1NWI=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 75071c3a113cec24136e847c1e3f0c2da8d44a5dd77a376d421f725b91b39c3e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b5178dce91914b8ff55b109e2b39d6eca6ca332b1c921e086e1a5ca06e70155b", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8 policy_hash = a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWI2MzAyODNkYTQ5ZDBkYWUyZWVmMDdkZjNhN2NjN2FjMzcxZGM5MGQ0OGMxMDdiZTE0MDc0YTM0MTBlOTlmOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWEwOWViNDI3NDgxZTQ0NTkxYmQ5YTg3Y2ZlNGI2Y2E3MzNjYmYzMzdjMzg3Mzg5NDQ0NDk0MjRhYzhiNzY5OTk=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 5b630283da49d0dae2eef07df3a7cc7ac371dc90d48c107be14074a3410e99f8,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=a09eb427481e44591bd9a87cfe4b6ca733cbf337c38738944449424ac8b76999", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e policy_hash = b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YjM0YzZkZDAwZjk1NzE0M2QzZjM0YWYwYmVlYjAzYjE5NDc4YWQ4MjVlYTkwZDdkMTg3Yjc0YWU4MTk0MTE1ZSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWIzYTQ5ZTc3NWY0MmU5ZmUwNjYyMDBkNjhhYjgzMjA1OGNmNDYzYmMyMTUwOTdhZDlmZDVhODA1MzMyODBhMWI=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = b34c6dd00f957143d3f34af0beeb03b19478ad825ea90d7d187b74ae8194115e,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b3a49e775f42e9fe066200d68ab832058cf463bc215097ad9fd5a80533280a1b", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:929: allow_overlay_layer: policy_id = 52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8 policy_hash = baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NTJlODVlOTUzMTQzYmJmMmViZjMyYjIzYmJlZWU1Nzk5ODRhY2Y0MWI5Y2UyOTI0YTY3OWNhNWQ5ZDhlYjFiOCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWJhYTdmMTA3Yjc4MWQxMGM1NDU2Yzg2YTQ4MmFhOTQ2ZWM5MDcxODY2NThiZjI0ZjJmMjMxNDU0ZTQ4MzAwNDY=", + "tests/kata/data/pod-many-layers/policy.rego:935: allow_overlay_layer: i_value_decoded = 52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:939: allow_overlay_layer: p_value = 52e85e953143bbf2ebf32b23bbeee579984acf41b9ce2924a679ca5d9d8eb1b8,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=baa7f107b781d10c5456c86a482aa946ec907186658bf24f2f231454e4830046", + "tests/kata/data/pod-many-layers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-many-layers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-many-layers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-many-layers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-many-layers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100", + "tests/kata/data/pod-many-layers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100", + "tests/kata/data/pod-many-layers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-many-layers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-many-layers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-many-layers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-many-layers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-many-layers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-many-layers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-many-layers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-many-layers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-many-layers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-many-layers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-many-layers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-many-layers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-many-layers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-many-layers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-many-layers/policy.rego:507: allow_args 2: policy args = [\"sh\", \"-c\", \"while true; do echo go; sleep 25; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:508: allow_args 2: input args = [\"sh\", \"-c\", \"while true; do echo go; sleep 25; done\"]", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = sh", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo go; sleep 25; done p_arg = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-many-layers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo go; sleep 25; done p_arg = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo go; sleep 25; done p_arg = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo go; sleep 25; done", + "tests/kata/data/pod-many-layers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-many-layers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-many-layers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"container=docker\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-many-layers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=many-layers\", \"container=docker\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\"]", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = HOSTNAME=many-layers", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-many-layers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-many-layers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = container=docker", + "tests/kata/data/pod-many-layers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-many-layers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-many-layers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-many-layers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-many-layers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-many-layers/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-many-layers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-many-layers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-many-layers/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-many-layers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-many-layers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-many-layers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-many-layers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-many-layers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-many-layers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = nginx i_value = bootloose", + "tests/kata/data/pod-many-layers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-many-layers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-many-layers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-many-layers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-many-layers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"python\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/baselibrary/python:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-many-layers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/2f2d56ca980c38212dd93439d6d02381ac24882a363a648ab3724666a410d100\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"bootloose\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/k0sproject/bootloose-ubuntu22.04:latest\", \"io.kubernetes.cri.sandbox-id\": \"1a97281baf36632476e6601c47269dfa70f153b73add2ecad27d682a267cc03c\", \"io.kubernetes.cri.sandbox-name\": \"many-layers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"b78866ba-f3f0-4467-96f7-f610d8db99ac\"}", + "tests/kata/data/pod-many-layers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-many-layers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-many-layers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-many-layers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-many-layers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-many-layers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-many-layers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-many-layers/policy.rego:149: allow_by_anno 2: i_s_name = many-layers p_s_name = many-layers", + "tests/kata/data/pod-many-layers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-many-layers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-many-layers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-many-layers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-many-layers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-many-layers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-many-layers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-many-layers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-many-layers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-many-layers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-many-layers/policy.rego:271: allow_container_annotation: p_value = python i_value = bootloose" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-persistent-volumes/prints.json b/tests/kata/data/pod-persistent-volumes/prints.json new file mode 100644 index 0000000..9a63d00 --- /dev/null +++ b/tests/kata/data/pod-persistent-volumes/prints.json @@ -0,0 +1,1509 @@ +[ + [], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f-2a9dcee0f0886a07-resolv.conf", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-persistent-volumes/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-persistent-volumes/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-persistent-volumes/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-persistent-volumes/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-persistent-volumes/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cnitest-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_persistent_20a48b4d-0fcd-4547-9183-6ab69262ba04\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"20a48b4d-0fcd-4547-9183-6ab69262ba04\", \"nerdctl/network-namespace\": \"/var/run/netns/cnitest-8951ee22-d2ae-ab42-5453-5920971b906d\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:149: allow_by_anno 2: i_s_name = persistent p_s_name = persistent", + "tests/kata/data/pod-persistent-volumes/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-persistent-volumes/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-persistent-volumes/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-persistent-volumes/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-persistent-volumes/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cnitest-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cnitest-8951ee22-d2ae-ab42-5453-5920971b906d", + "tests/kata/data/pod-persistent-volumes/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_persistent_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_persistent_20a48b4d-0fcd-4547-9183-6ab69262ba04", + "tests/kata/data/pod-persistent-volumes/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-persistent-volumes/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-persistent-volumes/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-persistent-volumes/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f", + "tests/kata/data/pod-persistent-volumes/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f-2a9dcee0f0886a07-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f-2a9dcee0f0886a07-resolv.conf", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-persistent-volumes/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-persistent-volumes/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-persistent-volumes/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-persistent-volumes/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-persistent-volumes/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-persistent-volumes/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-persistent-volumes/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-persistent-volumes/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-persistent-volumes/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-persistent-volumes/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-persistent-volumes/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-persistent-volumes/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-persistent-volumes/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-persistent-volumes/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-persistent-volumes/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-persistent-volumes/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-persistent-volumes/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-persistent-volumes/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f", + "tests/kata/data/pod-persistent-volumes/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-persistent-volumes/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/pod-persistent-volumes/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-persistent-volumes/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-persistent-volumes/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-persistent-volumes/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-persistent-volumes/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-persistent-volumes/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:558: allow_env: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:478: allow_process: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-persistent-volumes/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-persistent-volumes/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-persistent-volumes/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-persistent-volumes/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-persistent-volumes/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-persistent-volumes/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_persistent_20a48b4d-0fcd-4547-9183-6ab69262ba04\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"20a48b4d-0fcd-4547-9183-6ab69262ba04\", \"nerdctl/network-namespace\": \"/var/run/netns/cnitest-8951ee22-d2ae-ab42-5453-5920971b906d\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace" + ], + [], + [], + [], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-70e78869b61b0688-my-volume", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-ac7ed51509af50bb-hosts", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-75f405b2a4d10c44-termination-log", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-939ec8c725c03af2-hostname", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-338558fe91b38bf5-resolv.conf", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/..2024_05_08_18_18_11.2961826904", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/..2024_05_08_18_18_11.2961826904/ca.crt", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/..2024_05_08_18_18_11.2961826904/namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/..2024_05_08_18_18_11.2961826904/token", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/..data", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_18_11.2961826904", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/ca.crt", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount/token", + "tests/kata/data/pod-persistent-volumes/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-persistent-volumes/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-persistent-volumes/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-persistent-volumes/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-persistent-volumes/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-persistent-volumes/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-persistent-volumes/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-persistent-volumes/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-persistent-volumes/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cnitest-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"20a48b4d-0fcd-4547-9183-6ab69262ba04\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:149: allow_by_anno 2: i_s_name = persistent p_s_name = persistent", + "tests/kata/data/pod-persistent-volumes/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-persistent-volumes/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = container", + "tests/kata/data/pod-persistent-volumes/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-persistent-volumes/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-persistent-volumes/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-persistent-volumes/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f\", \"io.kubernetes.cri.sandbox-name\": \"persistent\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"20a48b4d-0fcd-4547-9183-6ab69262ba04\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-persistent-volumes/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-persistent-volumes/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:149: allow_by_anno 2: i_s_name = persistent p_s_name = persistent", + "tests/kata/data/pod-persistent-volumes/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-persistent-volumes/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-persistent-volumes/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-persistent-volumes/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-persistent-volumes/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-persistent-volumes/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-persistent-volumes/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-persistent-volumes/policy.rego:271: allow_container_annotation: p_value = busybox i_value = busybox", + "tests/kata/data/pod-persistent-volumes/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-persistent-volumes/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-persistent-volumes/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450", + "tests/kata/data/pod-persistent-volumes/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-persistent-volumes/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/$(sandbox-id)/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data", + "tests/kata/data/pod-persistent-volumes/policy.rego:775: mount_source_allows 3: source1 = ^$(cpath)/$(sandbox-id)/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:778: mount_source_allows 3: source2 = ^$(cpath)/$(sandbox-id)/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:781: mount_source_allows 3: source3 = ^$(cpath)/$(sandbox-id)/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/sandbox/ephemeral/data2\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/sandbox/ephemeral/data2$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/sandbox/ephemeral/data2$", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/ephemeral/data2", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-70e78869b61b0688-my-volume\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-[a-z0-9]{16}-my-volume$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-my-volume$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-70e78869b61b0688-my-volume", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = /dev/ttyS0", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = /dev/ttyS0", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /dev/ttyS0", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-ac7ed51509af50bb-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-ac7ed51509af50bb-hosts", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-75f405b2a4d10c44-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-75f405b2a4d10c44-termination-log", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-939ec8c725c03af2-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-939ec8c725c03af2-hostname", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-338558fe91b38bf5-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-338558fe91b38bf5-resolv.conf", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-persistent-volumes/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-persistent-volumes/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-persistent-volumes/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450-fbefa3825e8bd3eb-serviceaccount", + "tests/kata/data/pod-persistent-volumes/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy1\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"type_\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/busy2\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/my-volume\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)my-volume$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/ttyS0\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/dev/ttyS0\", \"type_\": \"bind\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:794: allow_storages: p_count = 5 i_count = 5", + "tests/kata/data/pod-persistent-volumes/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-persistent-volumes/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-persistent-volumes/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-persistent-volumes/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-persistent-volumes/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-persistent-volumes/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-persistent-volumes/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-persistent-volumes/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-persistent-volumes/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-persistent-volumes/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-persistent-volumes/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-persistent-volumes/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-persistent-volumes/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-persistent-volumes/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-persistent-volumes/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-persistent-volumes/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-persistent-volumes/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-persistent-volumes/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-persistent-volumes/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-persistent-volumes/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-persistent-volumes/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-persistent-volumes/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-persistent-volumes/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-persistent-volumes/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-persistent-volumes/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-persistent-volumes/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-persistent-volumes/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-persistent-volumes/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-persistent-volumes/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-persistent-volumes/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-persistent-volumes/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450", + "tests/kata/data/pod-persistent-volumes/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/29547a6b2b66f63e4b7ae3b4ee3de9b38100f0f309bb89c923f47660fdb3e450\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/ephemeral/data2\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/ephemeral/data2\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/ephemeral/data2\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/ephemeral/data2\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/ephemeral/data2\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:841: allow_storage_options 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1014: allow_mount_point 5: mount1 = ^/run/kata-containers/sandbox/ephemeral/data2$", + "tests/kata/data/pod-persistent-volumes/policy.rego:1018: allow_mount_point 5: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/ephemeral/data2", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"^$(cpath)/$(sandbox-id)/local/data$\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:841: allow_storage_options 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:982: allow_mount_point 3: mount1 = ^$(cpath)/$(sandbox-id)/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:985: allow_mount_point 3: mount2 = ^/run/kata-containers/shared/containers/$(sandbox-id)/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:988: allow_mount_point 3: mount3 = ^/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data$", + "tests/kata/data/pod-persistent-volumes/policy.rego:992: allow_mount_point 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data", + "tests/kata/data/pod-persistent-volumes/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:820: allow_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"^/run/kata-containers/sandbox/ephemeral/data2$\", \"options\": [], \"source\": \"tmpfs\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:821: allow_storage: i_storage = {\"driver\": \"local\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"local\", \"mount_point\": \"/run/kata-containers/shared/containers/cb3724318db4d1ddfafe9b75b46c9f4ad0d99a02e5bbba15ec7276f3fb46391f/local/data\", \"options\": [\"mode=0777\"], \"source\": \"local\"}", + "tests/kata/data/pod-persistent-volumes/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-persistent-volumes/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-persistent-volumes/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-persistent-volumes/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-persistent-volumes/policy.rego:507: allow_args 2: policy args = [\"sh\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:508: allow_args 2: input args = [\"sh\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:520: allow_arg 1: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-persistent-volumes/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:529: allow_arg 2: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-persistent-volumes/policy.rego:538: allow_arg 3: i = 0 i_arg = sh p_arg = sh", + "tests/kata/data/pod-persistent-volumes/policy.rego:542: allow_arg 3: p_arg3 = sh", + "tests/kata/data/pod-persistent-volumes/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=aks-nodepool1-38464071-vmss000000\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = HOSTNAME=aks-nodepool1-38464071-vmss000000", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-persistent-volumes/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-persistent-volumes/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-persistent-volumes/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-persistent-volumes/policy.rego:558: allow_env: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:478: allow_process: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-persistent-volumes/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-persistent-volumes/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-persistent-volumes/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/pod-persistent-volumes/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-persistent-volumes/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-persistent-volumes/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-persistent-volumes/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-persistent-volumes/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-persistent-volumes/policy.rego:85: CreateContainerRequest: true" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/pod-same-containers/prints.json b/tests/kata/data/pod-same-containers/prints.json new file mode 100644 index 0000000..8d9e433 --- /dev/null +++ b/tests/kata/data/pod-same-containers/prints.json @@ -0,0 +1,3506 @@ +[ + [], + [], + [], + [ + "tests/kata/data/pod-same-containers/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/pod-same-containers/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/pod-same-containers/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/pod-same-containers/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-same-containers/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/pod-same-containers/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73-7421ddf5d67aab1a-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-same-containers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_same-containers_5b6eaa52-24fd-4a6e-8371-936515f32c7f\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-6fcf525d-6c80-2df0-1830-663d81b995c6\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/pod-same-containers/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/pod-same-containers/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/pod-same-containers/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/pod-same-containers/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/pod-same-containers/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-6fcf525d-6c80-2df0-1830-663d81b995c6", + "tests/kata/data/pod-same-containers/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/pod-same-containers/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/pod-same-containers/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_same-containers_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/pod-same-containers/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_same-containers_5b6eaa52-24fd-4a6e-8371-936515f32c7f", + "tests/kata/data/pod-same-containers/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/pod-same-containers/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/pod-same-containers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-same-containers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-same-containers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73 regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-same-containers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73", + "tests/kata/data/pod-same-containers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-same-containers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-same-containers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-same-containers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-same-containers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73-7421ddf5d67aab1a-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73-7421ddf5d67aab1a-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/pod-same-containers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-same-containers/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/pod-same-containers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/pod-same-containers/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/pod-same-containers/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/pod-same-containers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-same-containers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-same-containers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-same-containers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73", + "tests/kata/data/pod-same-containers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-same-containers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-same-containers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-same-containers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-same-containers/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/pod-same-containers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1089: match_caps 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/pod-same-containers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-same-containers/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/pod-same-containers/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-same-containers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-same-containers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-same-containers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-same-containers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-same-containers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-same-containers/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/pod-same-containers/policy.rego:383: allow_masked_path: true", + "tests/kata/data/pod-same-containers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-same-containers/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/pod-same-containers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/pod-same-containers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-same-containers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/pod-same-containers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/pod-same-containers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-same-containers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/pod-same-containers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/pod-same-containers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-same-containers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/pod-same-containers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/pod-same-containers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-same-containers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/pod-same-containers/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-same-containers/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/pod-same-containers/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0396c0c0821b1f3b-hosts", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-a5a9d87ef5adeee7-termination-log", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-6e73cba1b0c2c91a-hostname", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-fc44e14f837ef2a1-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/..2024_05_08_18_21_16.3360422085", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/..2024_05_08_18_21_16.3360422085/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/..2024_05_08_18_21_16.3360422085/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/..2024_05_08_18_21_16.3360422085/token", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/..data", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_21_16.3360422085", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount/token", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-same-containers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox1 i_value = busybox1", + "tests/kata/data/pod-same-containers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-same-containers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-same-containers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-same-containers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-same-containers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-same-containers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-same-containers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-same-containers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-same-containers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-same-containers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73 regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-same-containers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26", + "tests/kata/data/pod-same-containers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-same-containers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-same-containers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-same-containers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-same-containers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0396c0c0821b1f3b-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0396c0c0821b1f3b-hosts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-a5a9d87ef5adeee7-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-a5a9d87ef5adeee7-termination-log", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-6e73cba1b0c2c91a-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-6e73cba1b0c2c91a-hostname", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-fc44e14f837ef2a1-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-fc44e14f837ef2a1-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26-0ab02792924eaf31-serviceaccount", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-same-containers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-same-containers/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-same-containers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-same-containers/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-same-containers/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-same-containers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-same-containers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-same-containers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26", + "tests/kata/data/pod-same-containers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-same-containers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-same-containers/policy.rego:464: allow_process: i terminal = true p terminal = true", + "tests/kata/data/pod-same-containers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-same-containers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-same-containers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1056: allow_caps: policy Bounding = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:1060: allow_caps: policy Effective = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1068: allow_caps: policy Permitted = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-same-containers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-same-containers/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-same-containers/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-same-containers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"TERM=xterm\", \"HOSTNAME=$(host-name)\", \"POD_NAME=$(sandbox-name)\", \"POD_NAMESPACE=default\", \"POD_IP=$(pod-ip)\"]", + "tests/kata/data/pod-same-containers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"TERM=xterm\", \"HOSTNAME=same-containers\", \"POD_NAME=same-containers\", \"POD_NAMESPACE=default\", \"POD_IP=10.244.0.19\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"]", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = HOSTNAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_IP=10.244.0.19", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:664: allow_pod_ip_var: true", + "tests/kata/data/pod-same-containers/policy.rego:602: allow_var 4: true", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = TERM=xterm", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-same-containers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-same-containers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-same-containers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:351: allow_masked_paths 1: p_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:354: allow_masked_paths 1: i_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:388: allow_readonly_paths 1: p_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:391: allow_readonly_paths 1: i_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox1", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox3 i_value = busybox1" + ], + [], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-2e8565bb63c4358e-hosts", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-cdd46f668b4907de-termination-log", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-66279b0ec718ddff-hostname", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-1d706e054d5a35eb-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/..2024_05_08_18_21_16.3360422085", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/..2024_05_08_18_21_16.3360422085/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/..2024_05_08_18_21_16.3360422085/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/..2024_05_08_18_21_16.3360422085/token", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/..data", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_21_16.3360422085", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount/token", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-same-containers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox1 i_value = busybox2", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox2", + "tests/kata/data/pod-same-containers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-same-containers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-same-containers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-same-containers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-same-containers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-same-containers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-same-containers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-same-containers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-same-containers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-same-containers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73 regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-same-containers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9", + "tests/kata/data/pod-same-containers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-same-containers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-same-containers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-same-containers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-same-containers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-2e8565bb63c4358e-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-2e8565bb63c4358e-hosts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-cdd46f668b4907de-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-cdd46f668b4907de-termination-log", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-66279b0ec718ddff-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-66279b0ec718ddff-hostname", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-1d706e054d5a35eb-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-1d706e054d5a35eb-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9-53ddca97f561311e-serviceaccount", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-same-containers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-same-containers/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-same-containers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-same-containers/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-same-containers/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-same-containers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-same-containers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-same-containers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9", + "tests/kata/data/pod-same-containers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-same-containers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-same-containers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-same-containers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-same-containers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-same-containers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1056: allow_caps: policy Bounding = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:1060: allow_caps: policy Effective = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1068: allow_caps: policy Permitted = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-same-containers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-same-containers/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-same-containers/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-same-containers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"POD_NAME=$(sandbox-name)\", \"POD_NAMESPACE=default\", \"POD_IP=$(pod-ip)\"]", + "tests/kata/data/pod-same-containers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=same-containers\", \"POD_NAME=same-containers\", \"POD_NAMESPACE=default\", \"POD_IP=10.244.0.19\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\"]", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = HOSTNAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_IP=10.244.0.19", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:664: allow_pod_ip_var: true", + "tests/kata/data/pod-same-containers/policy.rego:602: allow_var 4: true", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-same-containers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-same-containers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-same-containers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:351: allow_masked_paths 1: p_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:354: allow_masked_paths 1: i_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:388: allow_readonly_paths 1: p_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:391: allow_readonly_paths 1: i_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox3 i_value = busybox2" + ], + [], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-1f4b8b12570104a4-hosts", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-f186dcdcfb3b4b74-termination-log", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-f257bcef4144f455-hostname", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-fcec31796ec146b0-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/..2024_05_08_18_21_16.3360422085", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/..2024_05_08_18_21_16.3360422085/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/..2024_05_08_18_21_16.3360422085/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/..2024_05_08_18_21_16.3360422085/token", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/..data", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_21_16.3360422085", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount/token", + "tests/kata/data/pod-same-containers/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/pod-same-containers/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/pod-same-containers/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/pod-same-containers/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/pod-same-containers/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox1 i_value = busybox3", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox3", + "tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}", + "tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers", + "tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start", + "tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true", + "tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start", + "tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start", + "tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox3 i_value = busybox3", + "tests/kata/data/pod-same-containers/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/pod-same-containers/policy.rego:254: allow_container_name: true", + "tests/kata/data/pod-same-containers/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/pod-same-containers/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/pod-same-containers/policy.rego:324: allow_log_directory: start", + "tests/kata/data/pod-same-containers/policy.rego:331: allow_log_directory: true", + "tests/kata/data/pod-same-containers/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/pod-same-containers/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/pod-same-containers/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/pod-same-containers/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73 regex = ^[a-z0-9]{64}$", + "tests/kata/data/pod-same-containers/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/pod-same-containers/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092", + "tests/kata/data/pod-same-containers/policy.rego:713: allow_root_path: true", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/pod-same-containers/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/pod-same-containers/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/pod-same-containers/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/pod-same-containers/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-1f4b8b12570104a4-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-1f4b8b12570104a4-hosts", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-f186dcdcfb3b4b74-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-f186dcdcfb3b4b74-termination-log", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-f257bcef4144f455-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-f257bcef4144f455-hostname", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-fcec31796ec146b0-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-fcec31796ec146b0-resolv.conf", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:732: check_mount 1: true", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"rw\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"rw\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-same-containers/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/pod-same-containers/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/pod-same-containers/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092-cc9e8759f7c25f9e-serviceaccount", + "tests/kata/data/pod-same-containers/policy.rego:741: check_mount 2: true", + "tests/kata/data/pod-same-containers/policy.rego:727: allow_mount: true", + "tests/kata/data/pod-same-containers/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/pod-same-containers/policy.rego:794: allow_storages: p_count = 3 i_count = 3", + "tests/kata/data/pod-same-containers/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:805: allow_storages: layer_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-same-containers/policy.rego:808: allow_storages: root_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/pod-same-containers/policy.rego:958: allow_mount_point 1: layer_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\", \"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080:b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"], \"source\": \"\"}", + "tests/kata/data/pod-same-containers/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=\", \"io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"], \"source\": \"none\"}", + "tests/kata/data/pod-same-containers/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/pod-same-containers/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/pod-same-containers/policy.rego:850: allow_storage_options 2: policy_ids = [\"2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379\", \"2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552\"]", + "tests/kata/data/pod-same-containers/policy.rego:854: allow_storage_options 2: policy_hashes = [\"8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080\", \"b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f\"]", + "tests/kata/data/pod-same-containers/policy.rego:857: allow_storage_options 2: p_count = 2", + "tests/kata/data/pod-same-containers/policy.rego:862: allow_storage_options 2: i_count = 5", + "tests/kata/data/pod-same-containers/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/pod-same-containers/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/pod-same-containers/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379:2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379 policy_hash = 8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MmMzNDJhMTM3ZTY5M2M3ODk4YWVjMzZkYTEwNDdmMTkxZGM3YzE2ODdlNjYxOThhZGFjYzQzOWNmNGFkZjM3OSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTg1NjhjNzBjMGNjZmUwMDUxMDkyZTgxOGRhNzY5MTExYTU5ODgyY2QxOWRkNzk5ZDNiY2E1ZmZhODI3OTEwODA=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 2c342a137e693c7898aec36da1047f191dc7c1687e66198adacc439cf4adf379,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=8568c70c0ccfe0051092e818da769111a59882cd19dd799d3bca5ffa82791080", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:929: allow_overlay_layer: policy_id = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552 policy_hash = b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MjU3MGUzYTE5ZTFiZjIwZGRkYTQ1NDk4YTk2MjdmNjE1NTVkMmQ2YzAxNDc5YjliNzY0NjBiNjc5YjI3ZDU1Mix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWI2NDNiNjIxNzc0ODk4MzgzMGIyNmFjMTRhMzVhMzMyMmRkNTI4YzAwOTYzZWFhZGQ5MWVmNTVmNTEzZGM3M2Y=", + "tests/kata/data/pod-same-containers/policy.rego:935: allow_overlay_layer: i_value_decoded = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:939: allow_overlay_layer: p_value = 2570e3a19e1bf20ddda45498a9627f61555d2d6c01479b9b76460b679b27d552,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=b643b6217748983830b26ac14a35a3322dd528c00963eaadd91ef55f513dc73f", + "tests/kata/data/pod-same-containers/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/pod-same-containers/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/pod-same-containers/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/pod-same-containers/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/pod-same-containers/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092", + "tests/kata/data/pod-same-containers/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/pod-same-containers/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/611c5a52cccd11f12e2f6f90340914e5616aa615d1f8fdafb41380a531f1f092", + "tests/kata/data/pod-same-containers/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/pod-same-containers/policy.rego:832: allow_storage: true", + "tests/kata/data/pod-same-containers/policy.rego:814: allow_storages: true", + "tests/kata/data/pod-same-containers/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/pod-same-containers/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/pod-same-containers/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/pod-same-containers/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/pod-same-containers/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1056: allow_caps: policy Bounding = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:1060: allow_caps: policy Effective = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1078: match_caps 1: true", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1068: allow_caps: policy Permitted = [\"$(privileged_caps)\"]", + "tests/kata/data/pod-same-containers/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1074: match_caps 1: start", + "tests/kata/data/pod-same-containers/policy.rego:1081: match_caps 2: start", + "tests/kata/data/pod-same-containers/policy.rego:1092: match_caps 3: start", + "tests/kata/data/pod-same-containers/policy.rego:1097: match_caps 3: privileged_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_DAC_READ_SEARCH\", \"CAP_FOWNER\", \"CAP_FSETID\", \"CAP_KILL\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETPCAP\", \"CAP_LINUX_IMMUTABLE\", \"CAP_NET_BIND_SERVICE\", \"CAP_NET_BROADCAST\", \"CAP_NET_ADMIN\", \"CAP_NET_RAW\", \"CAP_IPC_LOCK\", \"CAP_IPC_OWNER\", \"CAP_SYS_MODULE\", \"CAP_SYS_RAWIO\", \"CAP_SYS_CHROOT\", \"CAP_SYS_PTRACE\", \"CAP_SYS_PACCT\", \"CAP_SYS_ADMIN\", \"CAP_SYS_BOOT\", \"CAP_SYS_NICE\", \"CAP_SYS_RESOURCE\", \"CAP_SYS_TIME\", \"CAP_SYS_TTY_CONFIG\", \"CAP_MKNOD\", \"CAP_LEASE\", \"CAP_AUDIT_WRITE\", \"CAP_AUDIT_CONTROL\", \"CAP_SETFCAP\", \"CAP_MAC_OVERRIDE\", \"CAP_MAC_ADMIN\", \"CAP_SYSLOG\", \"CAP_WAKE_ALARM\", \"CAP_BLOCK_SUSPEND\", \"CAP_AUDIT_READ\", \"CAP_PERFMON\", \"CAP_BPF\", \"CAP_CHECKPOINT_RESTORE\"]", + "tests/kata/data/pod-same-containers/policy.rego:1100: match_caps 3: true", + "tests/kata/data/pod-same-containers/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/pod-same-containers/policy.rego:499: allow_args 1: no args", + "tests/kata/data/pod-same-containers/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-same-containers/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo hello; sleep 10; done\"]", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:525: allow_arg 1: true", + "tests/kata/data/pod-same-containers/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo hello; sleep 10; done p_arg = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo hello; sleep 10; done", + "tests/kata/data/pod-same-containers/policy.rego:545: allow_arg 3: true", + "tests/kata/data/pod-same-containers/policy.rego:516: allow_args 2: true", + "tests/kata/data/pod-same-containers/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"POD_NAME=$(sandbox-name)\", \"POD_NAMESPACE=default\", \"POD_IP=$(pod-ip)\"]", + "tests/kata/data/pod-same-containers/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=same-containers\", \"POD_NAME=same-containers\", \"POD_NAMESPACE=default\", \"POD_IP=10.244.0.19\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\"]", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = HOSTNAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:621: allow_var 5: true", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:565: allow_var 1: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:576: allow_var 2: true", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = POD_IP=10.244.0.19", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:664: allow_pod_ip_var: true", + "tests/kata/data/pod-same-containers/policy.rego:602: allow_var 4: true", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = POD_IP p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAME=$(sandbox-name)", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAME=same-containers", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_NAMESPACE=default", + "tests/kata/data/pod-same-containers/policy.rego:573: allow_var 2: p_var2 = POD_IP=$(pod-ip)", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:590: allow_var 3: true", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/pod-same-containers/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/pod-same-containers/policy.rego:558: allow_env: true", + "tests/kata/data/pod-same-containers/policy.rego:478: allow_process: true", + "tests/kata/data/pod-same-containers/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/pod-same-containers/policy.rego:154: allow_by_anno 2: true", + "tests/kata/data/pod-same-containers/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/pod-same-containers/policy.rego:351: allow_masked_paths 1: p_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:354: allow_masked_paths 1: i_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:388: allow_readonly_paths 1: p_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:391: allow_readonly_paths 1: i_paths = []", + "tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true", + "tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/web/prints.json b/tests/kata/data/web/prints.json new file mode 100644 index 0000000..82483be --- /dev/null +++ b/tests/kata/data/web/prints.json @@ -0,0 +1,1631 @@ +[ + [], + [], + [], + [ + "tests/kata/data/web/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/web/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/web/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/web/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/web/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/web/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/web/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/web/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b-f0e92b7f714aa203-resolv.conf", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/web/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/web/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/web/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/web/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/web/policy.rego:90: allow_anno 1: start", + "tests/kata/data/web/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/web/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_web-0_a03a12a9-f2d5-4b92-952c-c47f68f7b795\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"web-0\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"a03a12a9-f2d5-4b92-952c-c47f68f7b795\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-441c0e6e-9425-52fd-473b-ffaf8eec9643\"}", + "tests/kata/data/web/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:107: allow_anno 2: true", + "tests/kata/data/web/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/web/policy.rego:136: allow_by_anno 1: i_s_name = web-0", + "tests/kata/data/web/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/web/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/web/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/web/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/web/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/web/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/web/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/web/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/web/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/web/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/web/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/web/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-441c0e6e-9425-52fd-473b-ffaf8eec9643", + "tests/kata/data/web/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/web/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/web/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_web-0_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/web/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_web-0_a03a12a9-f2d5-4b92-952c-c47f68f7b795", + "tests/kata/data/web/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/web/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/web/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/web/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/web/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/web/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b regex = ^[a-z0-9]{64}$", + "tests/kata/data/web/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/web/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/web/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b", + "tests/kata/data/web/policy.rego:713: allow_root_path: true", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/web/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/web/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/web/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/web/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b-f0e92b7f714aa203-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b-f0e92b7f714aa203-resolv.conf", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/web/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/web/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/web/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/web/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/web/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/web/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/web/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/web/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b", + "tests/kata/data/web/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:814: allow_storages: true", + "tests/kata/data/web/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/web/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/web/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/web/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/web/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/web/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/web/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/web/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/web/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/web/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/web/policy.rego:499: allow_args 1: no args", + "tests/kata/data/web/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/web/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/web/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/web/policy.rego:525: allow_arg 1: true", + "tests/kata/data/web/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/web/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/web/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/web/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web/policy.rego:516: allow_args 2: true", + "tests/kata/data/web/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/web/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:565: allow_var 1: true", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:576: allow_var 2: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:558: allow_env: true", + "tests/kata/data/web/policy.rego:478: allow_process: true", + "tests/kata/data/web/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/web/policy.rego:140: allow_by_anno 1: true", + "tests/kata/data/web/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/web/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/web/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/web/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/web/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/web/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/web/policy.rego:346: allow_linux: true", + "tests/kata/data/web/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/web/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/web/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/web/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true" + ], + [], + [], + [], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-8e80dc82103dadad-hosts", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-693bc9bb02ffa5f9-termination-log", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-4c26ca9c72f5f92f-hostname", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-911cc8f3fc1fac0f-resolv.conf", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-53c0b95bb07319ea-html", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-53c0b95bb07319ea-html/lost+found", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/..2024_05_08_18_27_27.2903191328", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/..2024_05_08_18_27_27.2903191328/ca.crt", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/..2024_05_08_18_27_27.2903191328/namespace", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/..2024_05_08_18_27_27.2903191328/token", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/..data", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_27_27.2903191328", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/ca.crt", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/namespace", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount/token", + "tests/kata/data/web/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/web/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/web/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/web/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/web/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/web/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = false", + "tests/kata/data/web/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/web/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/web/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/web/policy.rego:90: allow_anno 1: start", + "tests/kata/data/web/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/web/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b\", \"io.kubernetes.cri.sandbox-name\": \"web-0\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"a03a12a9-f2d5-4b92-952c-c47f68f7b795\"}", + "tests/kata/data/web/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web/policy.rego:107: allow_anno 2: true", + "tests/kata/data/web/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/web/policy.rego:136: allow_by_anno 1: i_s_name = web-0", + "tests/kata/data/web/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/web/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/web/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/web/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/web/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/web/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/web/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/web/policy.rego:250: allow_container_name: start", + "tests/kata/data/web/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/web/policy.rego:271: allow_container_annotation: p_value = nginx i_value = nginx", + "tests/kata/data/web/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/web/policy.rego:254: allow_container_name: true", + "tests/kata/data/web/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/web/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/web/policy.rego:324: allow_log_directory: start", + "tests/kata/data/web/policy.rego:331: allow_log_directory: true", + "tests/kata/data/web/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/web/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/web/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/web/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = bd9d8a7145f3d1b1306dac8a6ea24d35010ba5c35122ffe1bd2f0cc1bf77298b regex = ^[a-z0-9]{64}$", + "tests/kata/data/web/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/web/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/web/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1", + "tests/kata/data/web/policy.rego:713: allow_root_path: true", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/web/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/web/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/web/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/web/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-8e80dc82103dadad-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-[a-z0-9]{16}-hosts$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-8e80dc82103dadad-hosts", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-693bc9bb02ffa5f9-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-[a-z0-9]{16}-termination-log$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-693bc9bb02ffa5f9-termination-log", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-4c26ca9c72f5f92f-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-[a-z0-9]{16}-hostname$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-4c26ca9c72f5f92f-hostname", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-911cc8f3fc1fac0f-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-911cc8f3fc1fac0f-resolv.conf", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:732: check_mount 1: true", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-53c0b95bb07319ea-html\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-[a-z0-9]{16}-html$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-53c0b95bb07319ea-html", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/web/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/web/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1-ed27a22ae4256441-serviceaccount", + "tests/kata/data/web/policy.rego:741: check_mount 2: true", + "tests/kata/data/web/policy.rego:727: allow_mount: true", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web/policy.rego:794: allow_storages: p_count = 7 i_count = 7", + "tests/kata/data/web/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:805: allow_storages: layer_ids = [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"]", + "tests/kata/data/web/policy.rego:808: allow_storages: root_hashes = [\"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\", \"ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\", \"d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\", \"1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\", \"1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\", \"e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"]", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 2", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer2)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer2)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer2)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 3", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer3)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer3)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer3)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 4", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer4)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer4)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer4)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:955: allow_mount_point 1: i = 5", + "tests/kata/data/web/policy.rego:958: allow_mount_point 1: layer_id = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:1025: allow_mount_point 6: mount1 = $(layer5)", + "tests/kata/data/web/policy.rego:1028: allow_mount_point 6: mount2 = $(layer5)", + "tests/kata/data/web/policy.rego:1032: allow_mount_point 6: mount3 = $(layer5)", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web/policy.rego:850: allow_storage_options 2: policy_ids = [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"]", + "tests/kata/data/web/policy.rego:854: allow_storage_options 2: policy_hashes = [\"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\", \"ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\", \"d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\", \"1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\", \"1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\", \"e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"]", + "tests/kata/data/web/policy.rego:857: allow_storage_options 2: p_count = 6", + "tests/kata/data/web/policy.rego:862: allow_storage_options 2: i_count = 9", + "tests/kata/data/web/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/web/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/web/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2 policy_hash = 073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc policy_hash = ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983 policy_hash = d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c policy_hash = 1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7 policy_hash = 1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:929: allow_overlay_layer: policy_id = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a policy_hash = e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=", + "tests/kata/data/web/policy.rego:935: allow_overlay_layer: i_value_decoded = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:939: allow_overlay_layer: p_value = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/web/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1", + "tests/kata/data/web/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/web/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/61d94665cec0025e68f0bea6c4eea6e19b23f8c95a1a45f63a5315b0700d72b1", + "tests/kata/data/web/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web/policy.rego:832: allow_storage: true", + "tests/kata/data/web/policy.rego:814: allow_storages: true", + "tests/kata/data/web/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/web/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/web/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/web/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/web/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/web/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/web/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/web/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/web/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/web/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/web/policy.rego:499: allow_args 1: no args", + "tests/kata/data/web/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo $(sandbox-name); sleep 10; done\"]", + "tests/kata/data/web/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo web-0; sleep 10; done\"]", + "tests/kata/data/web/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/web/policy.rego:525: allow_arg 1: true", + "tests/kata/data/web/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/web/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/web/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/web/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/web/policy.rego:525: allow_arg 1: true", + "tests/kata/data/web/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/web/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/web/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/web/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo web-0; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/web/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo web-0; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/web/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo web-0; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/web/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo web-0; sleep 10; done", + "tests/kata/data/web/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web/policy.rego:516: allow_args 2: true", + "tests/kata/data/web/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"META_NAME=$(sandbox-name)\"]", + "tests/kata/data/web/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=web-0\", \"META_NAME=web-0\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\"]", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:565: allow_var 1: true", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:576: allow_var 2: true", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = HOSTNAME=web-0", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:621: allow_var 5: true", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = META_NAME=web-0", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:576: allow_var 2: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:573: allow_var 2: p_var2 = META_NAME=web-0", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:590: allow_var 3: true", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web/policy.rego:558: allow_env: true", + "tests/kata/data/web/policy.rego:478: allow_process: true", + "tests/kata/data/web/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/web/policy.rego:140: allow_by_anno 1: true", + "tests/kata/data/web/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/web/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/web/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/web/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/web/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/web/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/web/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/web/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/web/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/web/policy.rego:346: allow_linux: true", + "tests/kata/data/web/policy.rego:85: CreateContainerRequest: true" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/data/web2/prints.json b/tests/kata/data/web2/prints.json new file mode 100644 index 0000000..6e47f9b --- /dev/null +++ b/tests/kata/data/web2/prints.json @@ -0,0 +1,1621 @@ +[ + [], + [], + [], + [ + "tests/kata/data/web2/policy.rego:1162: CreateSandboxRequest: input.guest_hook_path = ", + "tests/kata/data/web2/policy.rego:1165: CreateSandboxRequest: input.kernel_modules = []", + "tests/kata/data/web2/policy.rego:1169: CreateSandboxRequest: i_pidns = false", + "tests/kata/data/web2/policy.rego:1124: allow_sandbox_storages: i_storages = [{\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}]", + "tests/kata/data/web2/policy.rego:1135: allow_sandbox_storage: i_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/web2/policy.rego:1138: allow_sandbox_storage: p_storage = {\"driver\": \"ephemeral\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tmpfs\", \"mount_point\": \"/run/kata-containers/sandbox/shm\", \"options\": [\"noexec\", \"nosuid\", \"nodev\", \"mode=1777\", \"size=67108864\"], \"source\": \"shm\"}", + "tests/kata/data/web2/policy.rego:1141: allow_sandbox_storage: true", + "tests/kata/data/web2/policy.rego:1131: allow_sandbox_storages: true" + ], + [], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656-4a4bba3a5a6c9b54-resolv.conf", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/web2/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/web2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web2/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false", + "tests/kata/data/web2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/web2/policy.rego:75: CreateContainerRequest: p Readonly = true i Readonly = true", + "tests/kata/data/web2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/web2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", + "tests/kata/data/web2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/default_web2-0_79e6d928-5d3e-4a7e-93d4-88cd828517b5\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"web2-0\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"79e6d928-5d3e-4a7e-93d4-88cd828517b5\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-9fd96ae5-97cc-f93f-1a4e-82ca887e931f\"}", + "tests/kata/data/web2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = nerdctl/network-namespace", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = nerdctl/network-namespace", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/web2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/web2/policy.rego:136: allow_by_anno 1: i_s_name = web2-0", + "tests/kata/data/web2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/web2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/web2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/web2/policy.rego:202: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", + "tests/kata/data/web2/policy.rego:211: allow_by_container_type 1: i_cri_type = sandbox", + "tests/kata/data/web2/policy.rego:215: allow_by_container_type 1: i_kata_type = pod_sandbox", + "tests/kata/data/web2/policy.rego:242: allow_sandbox_container_name: start", + "tests/kata/data/web2/policy.rego:258: container_annotation_missing: io.kubernetes.cri.container-name", + "tests/kata/data/web2/policy.rego:263: container_annotation_missing: true", + "tests/kata/data/web2/policy.rego:246: allow_sandbox_container_name: true", + "tests/kata/data/web2/policy.rego:280: allow_sandbox_net_namespace: start", + "tests/kata/data/web2/policy.rego:286: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-9fd96ae5-97cc-f93f-1a4e-82ca887e931f", + "tests/kata/data/web2/policy.rego:290: allow_sandbox_net_namespace: true", + "tests/kata/data/web2/policy.rego:306: allow_sandbox_log_directory: start", + "tests/kata/data/web2/policy.rego:313: allow_sandbox_log_directory: regex2 = ^/var/log/pods/default_web2-0_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "tests/kata/data/web2/policy.rego:316: allow_sandbox_log_directory: i_dir = /var/log/pods/default_web2-0_79e6d928-5d3e-4a7e-93d4-88cd828517b5", + "tests/kata/data/web2/policy.rego:320: allow_sandbox_log_directory: true", + "tests/kata/data/web2/policy.rego:222: allow_by_container_type 1: true", + "tests/kata/data/web2/policy.rego:226: allow_by_container_type 2: i_cri_type = sandbox", + "tests/kata/data/web2/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/web2/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/web2/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656 regex = ^[a-z0-9]{64}$", + "tests/kata/data/web2/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/web2/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/web2/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656", + "tests/kata/data/web2/policy.rego:713: allow_root_path: true", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/web2/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/web2/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/web2/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/web2/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656-4a4bba3a5a6c9b54-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656-4a4bba3a5a6c9b54-resolv.conf", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:794: allow_storages: p_count = 2 i_count = 2", + "tests/kata/data/web2/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:805: allow_storages: layer_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/web2/policy.rego:808: allow_storages: root_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"0001:00:01.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\", \"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:850: allow_storage_options 2: policy_ids = [\"5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d\"]", + "tests/kata/data/web2/policy.rego:854: allow_storage_options 2: policy_hashes = [\"817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18\"]", + "tests/kata/data/web2/policy.rego:857: allow_storage_options 2: p_count = 1", + "tests/kata/data/web2/policy.rego:862: allow_storage_options 2: i_count = 4", + "tests/kata/data/web2/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/web2/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/web2/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web2/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d policy_hash = 817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=NWE1YWFkODAwNTVmZjIwMDEyYTUwZGMyNWY4ZGY3YTI5OTI0NDc0MzI0ZDY1ZjdkNTMwNmVlOGVlMjdmZjcxZCx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTgxNzI1MGYxYTNlMzM2ZGE3NmY1YmQzZmE3ODRlMWIyNmQ5NTliOWMxMzE4NzY4MTViYTI2MDQwNDhiNzBjMTg=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = 5a5aad80055ff20012a50dc25f8df7a29924474324d65f7d5306ee8ee27ff71d,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=817250f1a3e336da76f5bd3fa784e1b26d959b9c131876815ba2604048b70c18", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656", + "tests/kata/data/web2/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:814: allow_storages: true", + "tests/kata/data/web2/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/web2/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/web2/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/web2/policy.rego:470: allow_process: i noNewPrivileges = true p noNewPrivileges = true", + "tests/kata/data/web2/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/web2/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/web2/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/web2/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/web2/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/web2/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:485: allow_user: input uid = 65535 policy uid = 65535", + "tests/kata/data/web2/policy.rego:499: allow_args 1: no args", + "tests/kata/data/web2/policy.rego:507: allow_args 2: policy args = [\"/pause\"]", + "tests/kata/data/web2/policy.rego:508: allow_args 2: input args = [\"/pause\"]", + "tests/kata/data/web2/policy.rego:520: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/web2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/web2/policy.rego:529: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/web2/policy.rego:538: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", + "tests/kata/data/web2/policy.rego:542: allow_arg 3: p_arg3 = /pause", + "tests/kata/data/web2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web2/policy.rego:516: allow_args 2: true", + "tests/kata/data/web2/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/web2/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:565: allow_var 1: true", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:576: allow_var 2: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:558: allow_env: true", + "tests/kata/data/web2/policy.rego:478: allow_process: true", + "tests/kata/data/web2/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/web2/policy.rego:140: allow_by_anno 1: true", + "tests/kata/data/web2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/web2/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web2/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web2/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/web2/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/asound", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/web2/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/web2/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web2/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web2/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/web2/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/web2/policy.rego:346: allow_linux: true", + "tests/kata/data/web2/policy.rego:85: CreateContainerRequest: true", + "tests/kata/data/web2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = false" + ], + [], + [], + [], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-c9d84ad063ec0742-hosts", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-63f9f7fea6333cd0-termination-log", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-034b80350c1ccbb7-hostname", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-c39c3fd00fbf3239-resolv.conf", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-43e927ff560a6360-html", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/..2024_05_08_18_30_45.15688249", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/..2024_05_08_18_30_45.15688249/ca.crt", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/..2024_05_08_18_30_45.15688249/namespace", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/..2024_05_08_18_30_45.15688249/token", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/..data", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ..2024_05_08_18_30_45.15688249", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/ca.crt", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ..data/ca.crt", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/namespace", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ..data/namespace", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:1145: CopyFileRequest: input.path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount/token", + "tests/kata/data/web2/policy.rego:1117: check_symlink_source: i_src = ..data/token", + "tests/kata/data/web2/policy.rego:1154: CopyFileRequest: regex4 = ^/run/kata-containers/shared/containers/[a-z0-9]{64}-[a-z0-9]{16}-", + "tests/kata/data/web2/policy.rego:1158: CopyFileRequest: true" + ], + [ + "tests/kata/data/web2/policy.rego:56: CreateContainerRequest: i_oci.Hooks = null", + "tests/kata/data/web2/policy.rego:59: CreateContainerRequest: i_oci.Linux.Seccomp = null", + "tests/kata/data/web2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web2/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = true", + "tests/kata/data/web2/policy.rego:63: ======== CreateContainerRequest: trying next policy container", + "tests/kata/data/web2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = true", + "tests/kata/data/web2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1", + "tests/kata/data/web2/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false", + "tests/kata/data/web2/policy.rego:90: allow_anno 1: start", + "tests/kata/data/web2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}", + "tests/kata/data/web2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginx2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/cbl-mariner/base/nginx:1.22.1-9-cm2.0.20230904-amd64\", \"io.kubernetes.cri.sandbox-id\": \"459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656\", \"io.kubernetes.cri.sandbox-name\": \"web2-0\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"79e6d928-5d3e-4a7e-93d4-88cd828517b5\"}", + "tests/kata/data/web2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", + "tests/kata/data/web2/policy.rego:123: allow_anno_key 2: true", + "tests/kata/data/web2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web2/policy.rego:115: allow_anno_key 1: true", + "tests/kata/data/web2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", + "tests/kata/data/web2/policy.rego:107: allow_anno 2: true", + "tests/kata/data/web2/policy.rego:129: allow_by_anno 1: start", + "tests/kata/data/web2/policy.rego:136: allow_by_anno 1: i_s_name = web2-0", + "tests/kata/data/web2/policy.rego:158: allow_by_sandbox_name: start", + "tests/kata/data/web2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default", + "tests/kata/data/web2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type", + "tests/kata/data/web2/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container", + "tests/kata/data/web2/policy.rego:211: allow_by_container_type 1: i_cri_type = container", + "tests/kata/data/web2/policy.rego:226: allow_by_container_type 2: i_cri_type = container", + "tests/kata/data/web2/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container", + "tests/kata/data/web2/policy.rego:250: allow_container_name: start", + "tests/kata/data/web2/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name", + "tests/kata/data/web2/policy.rego:271: allow_container_annotation: p_value = nginx2 i_value = nginx2", + "tests/kata/data/web2/policy.rego:275: allow_container_annotation: true", + "tests/kata/data/web2/policy.rego:254: allow_container_name: true", + "tests/kata/data/web2/policy.rego:294: allow_net_namespace: start", + "tests/kata/data/web2/policy.rego:301: allow_net_namespace: true", + "tests/kata/data/web2/policy.rego:324: allow_log_directory: start", + "tests/kata/data/web2/policy.rego:331: allow_log_directory: true", + "tests/kata/data/web2/policy.rego:237: allow_by_container_type 2: true", + "tests/kata/data/web2/policy.rego:207: allow_by_container_types: true", + "tests/kata/data/web2/policy.rego:436: allow_by_bundle_or_sandbox_id: start", + "tests/kata/data/web2/policy.rego:446: allow_by_bundle_or_sandbox_id: sandbox_id = 459053f3aa53bfe9ea3c7befdda6e1c12270527c9040d772a38f6caa8318a656 regex = ^[a-z0-9]{64}$", + "tests/kata/data/web2/policy.rego:703: allow_root_path: i_path = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470 p_path1 = $(cpath)/$(bundle-id)", + "tests/kata/data/web2/policy.rego:706: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)", + "tests/kata/data/web2/policy.rego:709: allow_root_path: p_path3 = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470", + "tests/kata/data/web2/policy.rego:713: allow_root_path: true", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = proc", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = proc", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= proc", + "tests/kata/data/web2/policy.rego:775: mount_source_allows 3: source1 = proc", + "tests/kata/data/web2/policy.rego:778: mount_source_allows 3: source2 = proc", + "tests/kata/data/web2/policy.rego:781: mount_source_allows 3: source3 = proc", + "tests/kata/data/web2/policy.rego:785: mount_source_allows 3: true", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = tmpfs", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = tmpfs", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= tmpfs", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = devpts", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = devpts", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= devpts", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = mqueue", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = mqueue", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= mqueue", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = sysfs", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = sysfs", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= sysfs", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = cgroup", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = cgroup", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= cgroup", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-c9d84ad063ec0742-hosts\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-[a-z0-9]{16}-hosts$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-c9d84ad063ec0742-hosts", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-63f9f7fea6333cd0-termination-log\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-[a-z0-9]{16}-termination-log$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-63f9f7fea6333cd0-termination-log", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-034b80350c1ccbb7-hostname\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-[a-z0-9]{16}-hostname$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-034b80350c1ccbb7-hostname", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-c39c3fd00fbf3239-resolv.conf\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-c39c3fd00fbf3239-resolv.conf", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:732: check_mount 1: true", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", + "tests/kata/data/web2/policy.rego:764: mount_source_allows 2: true", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/sandbox/shm", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-43e927ff560a6360-html\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-[a-z0-9]{16}-html$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-43e927ff560a6360-html", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:718: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:750: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/web2/policy.rego:753: mount_source_allows 1: true", + "tests/kata/data/web2/policy.rego:761: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", + "tests/kata/data/web2/policy.rego:767: mount_source_allows 3: i_mount.source= /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470-1474bdfcd7ea43a4-serviceaccount", + "tests/kata/data/web2/policy.rego:741: check_mount 2: true", + "tests/kata/data/web2/policy.rego:727: allow_mount: true", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:721: allow_mount: p_mount = {\"destination\": \"/usr/share/nginx/html\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-html$\", \"type_\": \"bind\"}", + "tests/kata/data/web2/policy.rego:794: allow_storages: p_count = 7 i_count = 7", + "tests/kata/data/web2/policy.rego:801: allow_storages: overlay_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:805: allow_storages: layer_ids = [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"]", + "tests/kata/data/web2/policy.rego:808: allow_storages: root_hashes = [\"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\", \"ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\", \"d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\", \"1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\", \"1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\", \"e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"]", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 0", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer0)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer0)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer0)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\"], \"source\": \"0001:00:02.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 1", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer1)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer1)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer1)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\"], \"source\": \"0001:00:03.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 2", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer2)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer2)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer2)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\"], \"source\": \"0001:00:04.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 3", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer3)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer3)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer3)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\"], \"source\": \"0001:00:05.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 4", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer4)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer4)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer4)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\"], \"source\": \"0001:00:06.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 0", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 1", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 2", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 3", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 4", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:895: allow_storage_options 3: i = 5", + "tests/kata/data/web2/policy.rego:898: allow_storage_options 3: hash_option = io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:906: allow_storage_options 3: true", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:955: allow_mount_point 1: i = 5", + "tests/kata/data/web2/policy.rego:958: allow_mount_point 1: layer_id = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web2/policy.rego:961: allow_mount_point 1: p_mount = /run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web2/policy.rego:965: allow_mount_point 1: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1042: allow_direct_vol_driver 1: true", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:1025: allow_mount_point 6: mount1 = $(layer5)", + "tests/kata/data/web2/policy.rego:1028: allow_mount_point 6: mount2 = $(layer5)", + "tests/kata/data/web2/policy.rego:1032: allow_mount_point 6: mount3 = $(layer5)", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"/run/kata-containers/sandbox/layers/8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"options\": [\"ro\", \"io.katacontainers.fs-opt.block_device=file\", \"io.katacontainers.fs-opt.is-layer\", \"io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"0001:00:07.0\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer0)\", \"options\": [\"$(hash0)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer1)\", \"options\": [\"$(hash1)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer2)\", \"options\": [\"$(hash2)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer3)\", \"options\": [\"$(hash3)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer4)\", \"options\": [\"$(hash4)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"blk\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"tar\", \"mount_point\": \"$(layer5)\", \"options\": [\"$(hash5)\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:820: allow_storage: p_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"$(cpath)/$(bundle-id)\", \"options\": [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\", \"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106:ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e:d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281:1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f:1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff:e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"], \"source\": \"\"}", + "tests/kata/data/web2/policy.rego:821: allow_storage: i_storage = {\"driver\": \"overlayfs\", \"driver_options\": [], \"fs_group\": null, \"fstype\": \"fuse3.kata-overlay\", \"mount_point\": \"/run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470\", \"options\": [\"io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers\", \"io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=\", \"io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=\", \"io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=\", \"io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=\", \"io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=\", \"io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=\", \"io.katacontainers.fs-opt.overlay-rw\", \"lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"], \"source\": \"none\"}", + "tests/kata/data/web2/policy.rego:836: allow_storage_options 1: start", + "tests/kata/data/web2/policy.rego:844: allow_storage_options 2: start", + "tests/kata/data/web2/policy.rego:850: allow_storage_options 2: policy_ids = [\"1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2\", \"c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc\", \"cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983\", \"14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c\", \"fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7\", \"8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a\"]", + "tests/kata/data/web2/policy.rego:854: allow_storage_options 2: policy_hashes = [\"073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106\", \"ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e\", \"d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281\", \"1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f\", \"1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff\", \"e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071\"]", + "tests/kata/data/web2/policy.rego:857: allow_storage_options 2: p_count = 6", + "tests/kata/data/web2/policy.rego:862: allow_storage_options 2: i_count = 9", + "tests/kata/data/web2/policy.rego:865: allow_storage_options 2: i_storage.options[0] = io.katacontainers.fs-opt.layer-src-prefix=/var/lib/containerd/io.containerd.snapshotter.v1.tardev/layers", + "tests/kata/data/web2/policy.rego:868: allow_storage_options 2: i_storage.options[i_count - 2] = io.katacontainers.fs-opt.overlay-rw", + "tests/kata/data/web2/policy.rego:872: allow_storage_options 2: lowerdir = lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web2/policy.rego:874: allow_storage_options 2: i_storage.options[i_count - 1] = lowerdir=1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2:c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc:cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983:14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c:fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7:8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2 policy_hash = 073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MWIyN2JlYzA2ODAxNmZjZTIzMGEzYzlmNDkyMGQzYmU3MjUxZTViYWFkYTdkY2EzMjA0YTkzMmNiY2RlMjdlMix0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTA3M2RiYTc4MzEyOTMxMDdmODg3M2VlZGFiZjQ5MjJkMTZhNTA2MDg2ZjZmNDZiMTliNGMyMzg2ODMxYzMxMDY=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = 1b27bec068016fce230a3c9f4920d3be7251e5baada7dca3204a932cbcde27e2,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=073dba7831293107f8873eedabf4922d16a506086f6f46b19b4c2386831c3106", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc policy_hash = ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=YzgyOTVjODBhNzljMmVkNzZlMDNkZGIyYWYzOTBhYzM3OTFiODc3OWRhNzk4Y2IxODNmYTk4NWNlNWNlZTFkYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWVkMGZlYWU0ZjRkY2NiNjg2NjI4OTYzYjFmMWY1ZGFlN2IzZTAxNWM4ODFlNzJmMDA1ZmYyZjk5YzY0OTQ1N2U=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = c8295c80a79c2ed76e03ddb2af390ac3791b8779da798cb183fa985ce5cee1dc,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=ed0feae4f4dccb686628963b1f1f5dae7b3e015c881e72f005ff2f99c649457e", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983 policy_hash = d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=Y2ZiOWZlOTdhMTg2OWVlOWIwZGFhZTNkOGNkNTk3MjBjZjM3MWRhNTY4YTZjMTRiYmExNmQ5ODJlNzA5Mjk4Myx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWQxMzgxNTJiNjYwZDJkYmNjNTA4MmFmYWU1OGVkYjFiZjBlZTU3NDJiOTE5MzNhMmY2MTY2NGI4NDdiMjMyODE=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = cfb9fe97a1869ee9b0daae3d8cd59720cf371da568a6c14bba16d982e7092983,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=d138152b660d2dbcc5082afae58edb1bf0ee5742b91933a2f61664b847b23281", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c policy_hash = 1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=MTRmMzk1NjQ3ODY5YTg4ZjkwYTMzZWVmNTBjOTdlODJmNGI5ODFiNmUyMGE1ODRkNTFiZjMwNDk2N2I4NTQyYyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFkNjllYWY1YzVjMjU3MzFlOWE4ZWJiMDM4Yzk0MmY2YWE2YWZmNWIxNWIxMWQ4YmQ0NDQzMWU1MTRjY2Q2OWY=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = 14f395647869a88f90a33eef50c97e82f4b981b6e20a584d51bf304967b8542c,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1d69eaf5c5c25731e9a8ebb038c942f6aa6aff5b15b11d8bd44431e514ccd69f", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7 policy_hash = 1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=ZmM3ZGQ4NjE0ODIwYmJhZmU1YjZiNjY0NWUxOTk0NWI0YWY5ODliNjYyYzk4OWZkNDZjNDY1ZmFmY2E3MDJmNyx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPTFlYjRiZmY4MDQwYTg2YzUxNDgxNWEwMzlmNmNiNGQ3YWE0YzVmMWI3YTJlMWE0NWY2Zjg2Y2E4Yzc3MGZmZmY=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = fc7dd8614820bbafe5b6b6645e19945b4af989b662c989fd46c465fafca702f7,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=1eb4bff8040a86c514815a039f6cb4d7aa4c5f1b7a2e1a45f6f86ca8c770ffff", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:929: allow_overlay_layer: policy_id = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a policy_hash = e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:930: allow_overlay_layer: i_option = io.katacontainers.fs-opt.layer=OGQzMTFlOGU1MTk4NGNhYmFjY2VjMWZiZmNiY2RkN2JmNTJhOGE5NzgxNjljZDIwYWYwN2JiZDFjM2E0NjkyYSx0YXIscm8saW8ua2F0YWNvbnRhaW5lcnMuZnMtb3B0LmJsb2NrX2RldmljZT1maWxlLGlvLmthdGFjb250YWluZXJzLmZzLW9wdC5pcy1sYXllcixpby5rYXRhY29udGFpbmVycy5mcy1vcHQucm9vdC1oYXNoPWU5MjhmZmY5OGRkZWEyZDI2ZGJiYTA3NTYwNTc3MGJkNmY2ZWYwNjhjOTc1Mjg5YjQ5YWNiM2Q1NTAzMGQwNzE=", + "tests/kata/data/web2/policy.rego:935: allow_overlay_layer: i_value_decoded = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:939: allow_overlay_layer: p_value = 8d311e8e51984cabaccec1fbfcbcdd7bf52a8a978169cd20af07bbd1c3a4692a,tar,ro,io.katacontainers.fs-opt.block_device=file,io.katacontainers.fs-opt.is-layer,io.katacontainers.fs-opt.root-hash=e928fff98ddea2d26dbba075605770bd6f6ef068c975289b49acb3d55030d071", + "tests/kata/data/web2/policy.rego:943: allow_overlay_layer: true", + "tests/kata/data/web2/policy.rego:881: allow_storage_options 2: true", + "tests/kata/data/web2/policy.rego:884: allow_storage_options 3: start", + "tests/kata/data/web2/policy.rego:909: allow_storage_options 4: start", + "tests/kata/data/web2/policy.rego:972: allow_mount_point 2: mount2 = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470", + "tests/kata/data/web2/policy.rego:976: allow_mount_point 2: true", + "tests/kata/data/web2/policy.rego:1021: allow_mount_point 6: i_storage.mount_point = /run/kata-containers/shared/containers/d955586a9452d731577ea25c085b6c709a6738fbd0303f71d188a10cb8a1b470", + "tests/kata/data/web2/policy.rego:1040: allow_direct_vol_driver 1: start", + "tests/kata/data/web2/policy.rego:1045: allow_direct_vol_driver 2: start", + "tests/kata/data/web2/policy.rego:832: allow_storage: true", + "tests/kata/data/web2/policy.rego:814: allow_storages: true", + "tests/kata/data/web2/policy.rego:457: allow_by_bundle_or_sandbox_id: true", + "tests/kata/data/web2/policy.rego:464: allow_process: i terminal = false p terminal = false", + "tests/kata/data/web2/policy.rego:467: allow_process: i cwd = / i cwd = /", + "tests/kata/data/web2/policy.rego:470: allow_process: i noNewPrivileges = false p noNewPrivileges = false", + "tests/kata/data/web2/policy.rego:1052: allow_caps: policy Ambient = []", + "tests/kata/data/web2/policy.rego:1053: allow_caps: input Ambient = []", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1056: allow_caps: policy Bounding = [\"$(default_caps)\"]", + "tests/kata/data/web2/policy.rego:1057: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1060: allow_caps: policy Effective = [\"$(default_caps)\"]", + "tests/kata/data/web2/policy.rego:1061: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1064: allow_caps: policy Inheritable = []", + "tests/kata/data/web2/policy.rego:1065: allow_caps: input Inheritable = []", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1078: match_caps 1: true", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:1068: allow_caps: policy Permitted = [\"$(default_caps)\"]", + "tests/kata/data/web2/policy.rego:1069: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1074: match_caps 1: start", + "tests/kata/data/web2/policy.rego:1081: match_caps 2: start", + "tests/kata/data/web2/policy.rego:1086: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", + "tests/kata/data/web2/policy.rego:1089: match_caps 2: true", + "tests/kata/data/web2/policy.rego:1092: match_caps 3: start", + "tests/kata/data/web2/policy.rego:485: allow_user: input uid = 0 policy uid = 0", + "tests/kata/data/web2/policy.rego:499: allow_args 1: no args", + "tests/kata/data/web2/policy.rego:507: allow_args 2: policy args = [\"/bin/sh\", \"-c\", \"while true; do echo $(sandbox-name); sleep 10; done\"]", + "tests/kata/data/web2/policy.rego:508: allow_args 2: input args = [\"/bin/sh\", \"-c\", \"while true; do echo web2-0; sleep 10; done\"]", + "tests/kata/data/web2/policy.rego:520: allow_arg 1: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/web2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/web2/policy.rego:529: allow_arg 2: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/web2/policy.rego:538: allow_arg 3: i = 0 i_arg = /bin/sh p_arg = /bin/sh", + "tests/kata/data/web2/policy.rego:542: allow_arg 3: p_arg3 = /bin/sh", + "tests/kata/data/web2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web2/policy.rego:520: allow_arg 1: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/web2/policy.rego:525: allow_arg 1: true", + "tests/kata/data/web2/policy.rego:529: allow_arg 2: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/web2/policy.rego:538: allow_arg 3: i = 1 i_arg = -c p_arg = -c", + "tests/kata/data/web2/policy.rego:542: allow_arg 3: p_arg3 = -c", + "tests/kata/data/web2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web2/policy.rego:520: allow_arg 1: i = 2 i_arg = while true; do echo web2-0; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/web2/policy.rego:529: allow_arg 2: i = 2 i_arg = while true; do echo web2-0; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/web2/policy.rego:538: allow_arg 3: i = 2 i_arg = while true; do echo web2-0; sleep 10; done p_arg = while true; do echo $(sandbox-name); sleep 10; done", + "tests/kata/data/web2/policy.rego:542: allow_arg 3: p_arg3 = while true; do echo web2-0; sleep 10; done", + "tests/kata/data/web2/policy.rego:545: allow_arg 3: true", + "tests/kata/data/web2/policy.rego:516: allow_args 2: true", + "tests/kata/data/web2/policy.rego:550: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"META_NAME=$(sandbox-name)\"]", + "tests/kata/data/web2/policy.rego:551: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=web2-0\", \"META_NAME=web2-0\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\"]", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:565: allow_var 1: true", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:576: allow_var 2: true", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = HOSTNAME=web2-0", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:621: allow_var 5: true", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:576: allow_var 2: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:656: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:668: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = META_NAME=$(sandbox-name)", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:554: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = HOSTNAME=$(host-name)", + "tests/kata/data/web2/policy.rego:573: allow_var 2: p_var2 = META_NAME=web2-0", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:590: allow_var 3: true", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_HOST=((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^[A-Z0-9_\\.\\-]+_PORT=tcp://((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4}:[0-9]{1,5}$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]*$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", + "tests/kata/data/web2/policy.rego:587: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", + "tests/kata/data/web2/policy.rego:558: allow_env: true", + "tests/kata/data/web2/policy.rego:478: allow_process: true", + "tests/kata/data/web2/policy.rego:171: allow_by_sandbox_name: true", + "tests/kata/data/web2/policy.rego:140: allow_by_anno 1: true", + "tests/kata/data/web2/policy.rego:143: allow_by_anno 2: start", + "tests/kata/data/web2/policy.rego:336: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web2/policy.rego:339: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", + "tests/kata/data/web2/policy.rego:351: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/web2/policy.rego:354: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/acpi", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/kcore", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/keys", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/latency_stats", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_list", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/timer_stats", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/sched_debug", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /proc/scsi", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:378: allow_masked_path: p_elem = /sys/firmware", + "tests/kata/data/web2/policy.rego:383: allow_masked_path: true", + "tests/kata/data/web2/policy.rego:358: allow_masked_paths 1: true", + "tests/kata/data/web2/policy.rego:361: allow_masked_paths 2: start", + "tests/kata/data/web2/policy.rego:388: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web2/policy.rego:391: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/asound", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/asound", + "tests/kata/data/web2/policy.rego:430: allow_readonly_path 2: true", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/bus", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/bus", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/fs", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/fs", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/irq", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/irq", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sys", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sys", + "tests/kata/data/web2/policy.rego:417: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web2/policy.rego:422: allow_readonly_path 1: true", + "tests/kata/data/web2/policy.rego:425: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", + "tests/kata/data/web2/policy.rego:395: allow_readonly_paths 1: true", + "tests/kata/data/web2/policy.rego:398: allow_readonly_paths 2: start", + "tests/kata/data/web2/policy.rego:346: allow_linux: true", + "tests/kata/data/web2/policy.rego:85: CreateContainerRequest: true" + ], + [] +] \ No newline at end of file diff --git a/tests/kata/main.rs b/tests/kata/main.rs index 43428db..c19eb91 100644 --- a/tests/kata/main.rs +++ b/tests/kata/main.rs @@ -40,6 +40,7 @@ fn run_kata_tests( let policy_file = path.join("policy.rego"); let inputs_file = path.join("inputs.txt"); let outputs_file = path.join("outputs.json"); + let prints_file = path.join("prints.json"); let mut engine = Engine::new(); engine.add_policy_from_file(&policy_file)?; @@ -62,6 +63,19 @@ fn run_kata_tests( .collect() }; + let mut prints: Vec> = if generate { + vec![] + } else { + let prints_json = std::fs::read_to_string(&prints_file).map_err(|e| { + anyhow::Error::msg(format!("could not read {}\n{e}", prints_file.display())) + })?; + + serde_json::from_str::>>(&prints_json)? + .into_iter() + .rev() + .collect() + }; + let inputs = std::fs::read_to_string(&inputs_file)?; for (lineno, line) in inputs.split('\n').enumerate() { let line = line.trim(); @@ -96,9 +110,14 @@ fn run_kata_tests( if generate { results.push(r); + prints.push(engine.take_prints()?); } else { let expected = results.pop().unwrap(); assert_eq!(r, expected, "{lineno} failed in {}", inputs_file.display()); + + let p = engine.take_prints()?; + assert_eq!(p, new_engine.take_prints()?); + assert_eq!(p, prints.pop().unwrap()); } num_queries += 2; @@ -106,6 +125,7 @@ fn run_kata_tests( if generate { std::fs::write(outputs_file, Value::from(results).to_json_str()?)?; + std::fs::write(prints_file, serde_json::to_string_pretty(&prints)?)?; } if coverage {