diff --git a/.github/workflows/master.yaml b/.github/workflows/master.yaml index aab40c4..152bef2 100644 --- a/.github/workflows/master.yaml +++ b/.github/workflows/master.yaml @@ -16,8 +16,7 @@ jobs: name: Continous integration runs-on: ubuntu-18.04 steps: - - name: checkout - uses: actions/checkout@v2 + - uses: actions/checkout@v2 - uses: azure/setup-helm@v1 with: version: "3.3.4" @@ -27,10 +26,10 @@ jobs: helm lint . --strict helm lint . --strict -f test/linter/values-lint.yaml helm dep up test/linter/subchart && helm lint test/linter/subchart --strict - # - name: conftest - # run: | - # conftest --version - # helm template . | conftest test --policy test/conftest/policy/ test --output table - + - name: conftest + run: | + helm template . > /tmp/cmak.yaml + conftest test /tmp/cmak.yaml -p test/conftest -o table --all-namespaces - name: start k8s with k3d uses: AbsaOSS/k3d-action@v1.3.1 with: diff --git a/test/conftest/policy/deployment.rego b/test/conftest/deployment.rego similarity index 58% rename from test/conftest/policy/deployment.rego rename to test/conftest/deployment.rego index 63a0cba..a52ca2b 100644 --- a/test/conftest/policy/deployment.rego +++ b/test/conftest/deployment.rego @@ -1,9 +1,9 @@ -package main +package main.deployment deny[msg] { input.kind == "Deployment" not input.spec.selector.matchLabels["app.kubernetes.io/name"] not input.spec.selector.matchLabels["app.kubernetes.io/instance"] - msg := "Containers must provide app.kubernetes.io/name and app.kubernetes.io/instance labels for pod selectors" + msg := "Containers must provide predefined labels for pod selectors" } diff --git a/test/conftest/ingress.rego b/test/conftest/ingress.rego new file mode 100644 index 0000000..8643c61 --- /dev/null +++ b/test/conftest/ingress.rego @@ -0,0 +1,6 @@ +package main.ingress + +deny[msg] { + input.kind == "Ingress" + msg := "Ingress must not be created by default" +}