mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
a29bfeeb4f
* fix: use early exit in 'some in' statements Update kata tests: Since 'early return' now works with 'some in' statement, interpreter does not do any evaluation after it found match for rule, therefore we don't have other rule checks after interpreter found match
996 lines
142 KiB
JSON
996 lines
142 KiB
JSON
[
|
|
[],
|
|
[],
|
|
[],
|
|
[
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1046: CreateSandboxRequest: i_pidns = false"
|
|
],
|
|
[],
|
|
[
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:84: allow_anno 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-rc-test-674df_eeb60852-0dcd-4387-b0f9-eebd63ddb7a8\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-rc-test-674df\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"eeb60852-0dcd-4387-b0f9-eebd63ddb7a8\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-939f1f21-5cec-1599-6804-471950c9c843\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:101: allow_anno 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:123: allow_by_anno 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:130: allow_by_anno 1: i_s_name = policy-rc-test-674df",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:152: allow_by_sandbox_name: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:205: allow_by_container_type 1: i_cri_type = sandbox",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:209: allow_by_container_type 1: i_kata_type = pod_sandbox",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:236: allow_sandbox_container_name: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:252: container_annotation_missing: io.kubernetes.cri.container-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:257: container_annotation_missing: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:240: allow_sandbox_container_name: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:274: allow_sandbox_net_namespace: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:280: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-939f1f21-5cec-1599-6804-471950c9c843",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:284: allow_sandbox_net_namespace: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:300: allow_sandbox_log_directory: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:307: allow_sandbox_log_directory: regex2 = ^/var/log/pods/kata-containers-k8s-tests_policy-rc-test-674df_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:310: allow_sandbox_log_directory: i_dir = /var/log/pods/kata-containers-k8s-tests_policy-rc-test-674df_eeb60852-0dcd-4387-b0f9-eebd63ddb7a8",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:314: allow_sandbox_log_directory: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:216: allow_by_container_type 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:220: allow_by_container_type 2: i_cri_type = sandbox",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:201: allow_by_container_types: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:430: allow_by_bundle_or_sandbox_id: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5 regex = ^[a-z0-9]{64}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:711: allow_root_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = proc",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = proc",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = tmpfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = tmpfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = devpts",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = devpts",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = mqueue",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = mqueue",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = sysfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = sysfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5-e1c85415dcc483c7-resolv.conf\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5-[a-z0-9]{16}-resolv.conf$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:452: allow_by_bundle_or_sandbox_id: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:459: allow_process: i terminal = false p terminal = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:462: allow_process: i cwd = / i cwd = /",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:465: allow_process: i noNewPrivileges = true p noNewPrivileges = true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:982: allow_caps: policy Ambient = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:983: allow_caps: input Ambient = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:994: allow_caps: policy Inheritable = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:995: allow_caps: input Inheritable = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:497: allow_args 1: no args",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:505: allow_args 2: policy args = [\"/pause\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:506: allow_args 2: input args = [\"/pause\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = /pause",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:514: allow_args 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:563: allow_var 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:574: allow_var 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:556: allow_env: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:473: allow_process: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:165: allow_by_sandbox_name: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:134: allow_by_anno 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:137: allow_by_anno 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/sys/devices/virtual/powercap\", \"/proc/scsi\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/acpi",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/asound",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/kcore",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/keys",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /sys/firmware",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/scsi",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:352: allow_masked_paths 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:355: allow_masked_paths 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:389: allow_readonly_paths 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:392: allow_readonly_paths 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:340: allow_linux: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:79: CreateContainerRequest: true"
|
|
],
|
|
[],
|
|
[],
|
|
[],
|
|
[],
|
|
[],
|
|
[
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:57: ======== CreateContainerRequest: trying next policy container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:84: allow_anno 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginxtest\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/sjenning/nginx:1.15-alpine\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"nginxtest\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/sjenning/nginx:1.15-alpine\", \"io.kubernetes.cri.sandbox-id\": \"c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5\", \"io.kubernetes.cri.sandbox-name\": \"policy-rc-test-674df\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"eeb60852-0dcd-4387-b0f9-eebd63ddb7a8\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:117: allow_anno_key 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:109: allow_anno_key 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:101: allow_anno 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:123: allow_by_anno 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:130: allow_by_anno 1: i_s_name = policy-rc-test-674df",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:152: allow_by_sandbox_name: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:196: allow_by_container_types: p_cri_type = container i_cri_type = container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:205: allow_by_container_type 1: i_cri_type = container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:220: allow_by_container_type 2: i_cri_type = container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:224: allow_by_container_type 2: i_kata_type = pod_container",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:244: allow_container_name: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:261: allow_container_annotation: key = io.kubernetes.cri.container-name",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:265: allow_container_annotation: p_value = nginxtest i_value = nginxtest",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:269: allow_container_annotation: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:248: allow_container_name: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:288: allow_net_namespace: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:295: allow_net_namespace: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:318: allow_log_directory: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:325: allow_log_directory: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:231: allow_by_container_type 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:201: allow_by_container_types: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:430: allow_by_bundle_or_sandbox_id: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5 regex = ^[a-z0-9]{64}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e/rootfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:711: allow_root_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = proc",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = proc",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = tmpfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = tmpfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = devpts",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = devpts",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = mqueue",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = mqueue",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = sysfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = sysfs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = cgroup",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = cgroup",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs/local/host-empty-vol\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/$(sandbox-id)/rootfs/local/host-empty-vol$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/c469f18bb1c58dab6be747450b77c3321e43ba5dd26d62d19a599b82bdb0ddc5/rootfs/local/host-empty-vol$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-01336f00e960a39f-hosts\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-hosts$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-90afc9ee3516c39f-termination-log\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-termination-log$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-094a24e380ead97f-hostname\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-hostname$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-530431b992f6d296-resolv.conf\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-resolv.conf$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:730: check_mount 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:762: mount_source_allows 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-cb7632a83c5a9dc3-serviceaccount\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/432a988cdb7fd4798e112d1a27a272d86e665dbfbdc4fc6937af127120b3a03e-[a-z0-9]{16}-serviceaccount$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:751: mount_source_allows 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:739: check_mount 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:725: allow_mount: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/host/cache\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"^$(cpath)/$(sandbox-id)/rootfs/local/host-empty-vol$\", \"type_\": \"local\"}",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:452: allow_by_bundle_or_sandbox_id: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:459: allow_process: i terminal = false p terminal = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:462: allow_process: i cwd = / i cwd = /",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:465: allow_process: i noNewPrivileges = false p noNewPrivileges = false",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:982: allow_caps: policy Ambient = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:983: allow_caps: input Ambient = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:994: allow_caps: policy Inheritable = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:995: allow_caps: input Inheritable = []",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1008: match_caps 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1004: match_caps 1: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1011: match_caps 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1019: match_caps 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:1022: match_caps 3: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:497: allow_args 1: no args",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:505: allow_args 2: policy args = [\"nginx\", \"-g\", \"daemon off;\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:506: allow_args 2: input args = [\"nginx\", \"-g\", \"daemon off;\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 0 i_arg = nginx p_arg = nginx",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 0 i_arg = nginx p_arg = nginx",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 0 i_arg = nginx p_arg = nginx",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = nginx",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 1 i_arg = -g p_arg = -g",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 1 i_arg = -g p_arg = -g",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 1 i_arg = -g p_arg = -g",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = -g",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:518: allow_arg 1: i = 2 i_arg = daemon off; p_arg = daemon off;",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:523: allow_arg 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:527: allow_arg 2: i = 2 i_arg = daemon off; p_arg = daemon off;",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:536: allow_arg 3: i = 2 i_arg = daemon off; p_arg = daemon off;",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:540: allow_arg 3: p_arg3 = daemon off;",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:543: allow_arg 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:514: allow_args 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"NGINX_VERSION=1.15.12\", \"HOSTNAME=$(host-name)\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=policy-rc-test-674df\", \"NGINX_VERSION=1.15.12\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:563: allow_var 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:574: allow_var 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = HOSTNAME=policy-rc-test-674df",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:619: allow_var 5: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:563: allow_var 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:574: allow_var 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT=443",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:552: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = NGINX_VERSION=1.15.12",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:588: allow_var 3: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:556: allow_env: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:473: allow_process: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:165: allow_by_sandbox_name: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:134: allow_by_anno 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:137: allow_by_anno 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/acpi",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/kcore",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/keys",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /proc/scsi",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:372: allow_masked_path: p_elem = /sys/firmware",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:377: allow_masked_path: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:352: allow_masked_paths 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:355: allow_masked_paths 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/asound",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/asound",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:424: allow_readonly_path 2: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:416: allow_readonly_path 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:389: allow_readonly_paths 1: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:392: allow_readonly_paths 2: start",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:340: allow_linux: true",
|
|
"tests/kata/data/k8s-policy-rc/policy.rego:79: CreateContainerRequest: true"
|
|
],
|
|
[],
|
|
[],
|
|
[],
|
|
[],
|
|
[]
|
|
] |