Using the Kyverno CLI to Write Policy Test Cases

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: ensure-readonly-hostpath
  annotations:
    policies.kyverno.io/title: Ensure Read Only hostPath
    policies.kyverno.io/category: Other
    policies.kyverno.io/severity: medium
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kyverno-version: 1.6.2
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Pods which are allowed to mount hostPath volumes in read/write mode pose a security risk
      even if confined to a "safe" file system on the host and may escape those confines (see
      https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts). The only true way
      to ensure safety is to enforce that all Pods mounting hostPath volumes do so in read only
      mode. This policy checks all containers for any hostPath volumes and ensures they are
      explicitly mounted in readOnly mode.      
spec:
  background: false
  validationFailureAction: Enforce
  rules:
  - name: ensure-hostpaths-readonly
    match:
      any:
      - resources:
          kinds:
            - Pod
    preconditions:
      all:
      - key: "{{ request.operation || 'BACKGROUND' }}"
        operator: AnyIn
        value:
        - CREATE
        - UPDATE
    validate:
      message: All hostPath volumes must be mounted as readOnly.
      foreach:
      - list: "request.object.spec.volumes[?hostPath][]"
        deny:
          conditions:
            any:
            - key: "{{ request.object.spec.[containers, initContainers, ephemeralContainers][].volumeMounts[?name == '{{element.name}}'][] | length(@) }}"
              operator: NotEquals
              value: "{{ request.object.spec.[containers, initContainers, ephemeralContainers][].volumeMounts[?name == '{{element.name}}' && readOnly] [] | length(@) }}"

apiVersion: v1
kind: Pod
metadata:
  name: nginx-without-readonly
spec:
  containers:
  - image: nginx:latest
    name: nginx
    volumeMounts:
    - mountPath: /data
      name: nginx-volume
  volumes:
  - name: nginx-volume
    hostPath:
      path: /data

---
apiVersion: v1
kind: Pod
metadata:
  name: nginx-with-readonly
spec:
  containers:
  - image: nginx:latest
    name: nginx
    volumeMounts:
    - mountPath: /data
      name: nginx-volume
      readOnly: true
  volumes:
  - name: nginx-volume
    hostPath:
      path: /data

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: resolve-image-to-digest
  annotations:
    policies.kyverno.io/title: Resolve Image to Digest
    policies.kyverno.io/category: Other
    policies.kyverno.io/severity: medium
    kyverno.io/kyverno-version: 1.6.0
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Image tags are mutable and the change of an image can result in the same tag.
      This policy resolves the image digest of each image in a container and replaces
      the image with the fully resolved reference which includes the digest rather than tag.      
spec:
  background: false
  rules:
  - name: resolve-to-digest
    match:
      any:
      - resources:
          kinds:
          - Pod
    preconditions:
      all:
      - key: "{{request.operation || 'BACKGROUND'}}"
        operator: NotEquals
        value: DELETE
    mutate:
      foreach:
      - list: "request.object.spec.containers"
        context:
          - name: resolvedRef
            imageRegistry:
              reference: "{{ element.image }}"
              jmesPath: "resolvedImage"
        patchStrategicMerge:
          spec:
            containers:
            - name: "{{ element.name }}"           
              image: "{{ resolvedRef }}"



kubectl apply -f resolve-image-to-digest.yaml
kubectl get clusterpolicies

apiVersion: v1
kind: Pod
metadata:
  name: nginx-app
spec:
  containers:
  - image: nginx:latest
    name: nginx

# values.yaml 
policies:
- name:  ensure-readonly-hostpath
  resources:
  - name: good-pod-01
    values:
      request.operation: UPDATE



# kyverno-test.yaml
name: ensure-readonly-hostpath
policies:
  -  ensure-readonly-hostpath.yaml
resources:
  - good-pod-01.yaml
  - bad-pod-01.yaml
variables: values.yaml
results:
  - policy: ensure-readonly-hostpath
    rule: ensure-hostpaths-readonly
    resource:  bad-pod-01
    kind: Pod
    result: fail
  - policy: ensure-readonly-hostpath
    rule: ensure-hostpaths-readonly
    resource:  good-pod-01
    kind: Pod
    result: pass

# values.yaml
policies:
  - name: resolve-image-to-digest
    rules:
      - name: resolve-to-digest
        values:
          resolvedRef: "busybox@sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47"
    resources:
      - name: busybox
        values:
          request.operation: UPDATE







# kyverno-test.yaml
name: resolve-image-to-digest
policies:
  - resolve-image-to-digest.yaml
resources:
  - pod.yaml
variables: values.yaml
results:
  - policy: resolve-image-to-digest
    rule: resolve-to-digest
    resource: busybox
    patchedResource: patchedResource.yaml
    kind: Pod
    result: pass





# patchedResource.yaml
apiVersion: v1
kind: Pod
metadata:
  name: busybox
spec:
  containers:
  - name: busybox
    image: busybox@sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47