mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Early return for 'some in' statement (#427)
* fix: use early exit in 'some in' statements Update kata tests: Since 'early return' now works with 'some in' statement, interpreter does not do any evaluation after it found match for rule, therefore we don't have other rule checks after interpreter found match
This commit is contained in:
Kirill Zabelin
@@ -397,19 +397,7 @@
|
||||
"tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = true"
|
||||
"tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true"
|
||||
],
|
||||
[],
|
||||
[],
|
||||
@@ -1346,129 +1334,7 @@
|
||||
"tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8906ef3aa3d8f75de0f95009e8fab3480bc5e7b118c51896b2e35d8df1fc2c26\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox1\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox3 i_value = busybox1"
|
||||
"tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true"
|
||||
],
|
||||
[],
|
||||
[
|
||||
@@ -2423,68 +2289,7 @@
|
||||
"tests/kata/data/pod-same-containers/policy.rego:395: allow_readonly_paths 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:398: allow_readonly_paths 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:346: allow_linux: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:67: CreateContainerRequest: p_pidns = false i_pidns = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:90: allow_anno 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox3\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.config.agent.policyOption.execCommands\": \"W3siY29udGFpbmVyTmFtZSI6ImJ1c3lib3gyIiwiZXhlY0NvbW1hbmRzIjpbImRoIC1oIiwicHMgLWVmIl19LCB7ImNvbnRhaW5lck5hbWUiOiJidXN5Ym94MyIsImV4ZWNDb21tYW5kcyI6WyJscyJdfV0=\", \"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/8ab188b8cbf32be40c40cbeaf26d340c100b586a9ba800fd1b3d505b735172b9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"971f00d742eb5728de5b147808f02a301d559b70c0dc17dcffd72855b4676a73\", \"io.kubernetes.cri.sandbox-name\": \"same-containers\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"5b6eaa52-24fd-4a6e-8371-936515f32c7f\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.config.agent.policyOption.execCommands\", \"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.config.agent.policyOption.execCommands",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.config.agent.policyOption.execCommands",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:123: allow_anno_key 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:115: allow_anno_key 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:107: allow_anno 2: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:129: allow_by_anno 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:143: allow_by_anno 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:149: allow_by_anno 2: i_s_name = same-containers p_s_name = same-containers",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:175: allow_sandbox_name 1: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:179: allow_sandbox_name 1: true",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:182: allow_sandbox_name 2: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:158: allow_by_sandbox_name: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:211: allow_by_container_type 1: i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:226: allow_by_container_type 2: i_cri_type = container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:250: allow_container_name: start",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name",
|
||||
"tests/kata/data/pod-same-containers/policy.rego:271: allow_container_annotation: p_value = busybox3 i_value = busybox2"
|
||||
"tests/kata/data/pod-same-containers/policy.rego:85: CreateContainerRequest: true"
|
||||
],
|
||||
[],
|
||||
[
|
||||
|
||||
Reference in New Issue
Block a user