PSA: update test fixtures

Signed-off-by: Peter Hunt <[email protected]> Kubernetes-commit: f53069eac65fa011262f440803efcfedd0a59e6a
kubernetes · Jul 17, 2024 · 6b00373 · 6b00373
1 parent 9833ddf
commit 6b00373
Show file tree

Hide file tree

Showing 257 changed files with 6,449 additions and 1 deletion.
diff --git a/test/run.go b/test/run.go
@@ -37,7 +37,7 @@ import (
 )
 
 const (
-	newestMinorVersionToTest            = 29
+	newestMinorVersionToTest            = 31
 	podOSBasedRestrictionEnabledVersion = 29
 )
 

diff --git a/test/testdata/baseline/v1.30/fail/apparmorprofile0.yaml b/test/testdata/baseline/v1.30/fail/apparmorprofile0.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    container.apparmor.security.beta.kubernetes.io/container1: unconfined
+  name: apparmorprofile0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
diff --git a/test/testdata/baseline/v1.30/fail/apparmorprofile1.yaml b/test/testdata/baseline/v1.30/fail/apparmorprofile1.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    container.apparmor.security.beta.kubernetes.io/initcontainer1: unconfined
+  name: apparmorprofile1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
diff --git a/test/testdata/baseline/v1.30/fail/capabilities_baseline0.yaml b/test/testdata/baseline/v1.30/fail/capabilities_baseline0.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: capabilities_baseline0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      capabilities:
+        add:
+        - NET_RAW
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      capabilities: {}
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/capabilities_baseline1.yaml b/test/testdata/baseline/v1.30/fail/capabilities_baseline1.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: capabilities_baseline1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      capabilities: {}
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      capabilities:
+        add:
+        - NET_RAW
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/capabilities_baseline2.yaml b/test/testdata/baseline/v1.30/fail/capabilities_baseline2.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: capabilities_baseline2
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      capabilities:
+        add:
+        - chown
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      capabilities: {}
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/capabilities_baseline3.yaml b/test/testdata/baseline/v1.30/fail/capabilities_baseline3.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: capabilities_baseline3
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      capabilities:
+        add:
+        - CAP_CHOWN
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      capabilities: {}
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/hostnamespaces0.yaml b/test/testdata/baseline/v1.30/fail/hostnamespaces0.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostnamespaces0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  hostIPC: true
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
diff --git a/test/testdata/baseline/v1.30/fail/hostnamespaces1.yaml b/test/testdata/baseline/v1.30/fail/hostnamespaces1.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostnamespaces1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  hostNetwork: true
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
diff --git a/test/testdata/baseline/v1.30/fail/hostnamespaces2.yaml b/test/testdata/baseline/v1.30/fail/hostnamespaces2.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostnamespaces2
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  hostPID: true
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
diff --git a/test/testdata/baseline/v1.30/fail/hostpathvolumes0.yaml b/test/testdata/baseline/v1.30/fail/hostpathvolumes0.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostpathvolumes0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+  volumes:
+  - emptyDir: {}
+    name: volume-emptydir
+  - hostPath:
+      path: /a
+    name: volume-hostpath
diff --git a/test/testdata/baseline/v1.30/fail/hostpathvolumes1.yaml b/test/testdata/baseline/v1.30/fail/hostpathvolumes1.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostpathvolumes1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+  volumes:
+  - hostPath:
+      path: /a
+    name: volume-hostpath-a
+  - hostPath:
+      path: /b
+    name: volume-hostpath-b
diff --git a/test/testdata/baseline/v1.30/fail/hostports0.yaml b/test/testdata/baseline/v1.30/fail/hostports0.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostports0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    ports:
+    - containerPort: 12345
+      hostPort: 12345
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
diff --git a/test/testdata/baseline/v1.30/fail/hostports1.yaml b/test/testdata/baseline/v1.30/fail/hostports1.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostports1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    ports:
+    - containerPort: 12346
+      hostPort: 12346
diff --git a/test/testdata/baseline/v1.30/fail/hostports2.yaml b/test/testdata/baseline/v1.30/fail/hostports2.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostports2
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    ports:
+    - containerPort: 12345
+      hostPort: 12345
+    - containerPort: 12347
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    ports:
+    - containerPort: 12346
+      hostPort: 12346
+    - containerPort: 12348
diff --git a/test/testdata/baseline/v1.30/fail/privileged0.yaml b/test/testdata/baseline/v1.30/fail/privileged0.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: privileged0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      privileged: true
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext: {}
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/privileged1.yaml b/test/testdata/baseline/v1.30/fail/privileged1.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: privileged1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext: {}
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      privileged: true
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/procmount0.yaml b/test/testdata/baseline/v1.30/fail/procmount0.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: procmount0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      procMount: Unmasked
+  hostUsers: false
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext: {}
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/procmount1.yaml b/test/testdata/baseline/v1.30/fail/procmount1.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: procmount1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext: {}
+  hostUsers: false
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      procMount: Unmasked
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/seccompprofile_baseline0.yaml b/test/testdata/baseline/v1.30/fail/seccompprofile_baseline0.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: seccompprofile_baseline0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext: {}
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext: {}
+  securityContext:
+    seccompProfile:
+      type: Unconfined
diff --git a/test/testdata/baseline/v1.30/fail/seccompprofile_baseline1.yaml b/test/testdata/baseline/v1.30/fail/seccompprofile_baseline1.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: seccompprofile_baseline1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      seccompProfile:
+        type: Unconfined
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext: {}
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/seccompprofile_baseline2.yaml b/test/testdata/baseline/v1.30/fail/seccompprofile_baseline2.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: seccompprofile_baseline2
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext: {}
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      seccompProfile:
+        type: Unconfined
+  securityContext: {}
diff --git a/test/testdata/baseline/v1.30/fail/selinuxoptions0.yaml b/test/testdata/baseline/v1.30/fail/selinuxoptions0.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: selinuxoptions0
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      seLinuxOptions: {}
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      seLinuxOptions: {}
+  securityContext:
+    seLinuxOptions:
+      type: somevalue
diff --git a/test/testdata/baseline/v1.30/fail/selinuxoptions1.yaml b/test/testdata/baseline/v1.30/fail/selinuxoptions1.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: selinuxoptions1
+spec:
+  containers:
+  - image: registry.k8s.io/pause
+    name: container1
+    securityContext:
+      seLinuxOptions:
+        type: somevalue
+  initContainers:
+  - image: registry.k8s.io/pause
+    name: initcontainer1
+    securityContext:
+      seLinuxOptions: {}
+  securityContext:
+    seLinuxOptions: {}
-Original file line number
+Diff line change
@@ Expand Up / @@ -37,7 +37,7 @@ import ( @@
     )
     const (
-    	newestMinorVersionToTest            = 29
+    	newestMinorVersionToTest            = 31
     	podOSBasedRestrictionEnabledVersion = 29
     )
@@ Expand Down @@