chore: adding cel for psp/volume and psp/selinux #530
Conversation
Signed-off-by: Jaydip Gabani <[email protected]>
Signed-off-by: Jaydip Gabani <[email protected]>
JaydipGabani
changed the title
Signed-off-by: Jaydip Gabani <[email protected]>
Signed-off-by: Jaydip Gabani <[email protected]>
Signed-off-by: Jaydip Gabani <[email protected]>
Signed-off-by: Jaydip Gabani <[email protected]>
|
This issue/PR has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions. |
| variables: | ||
| - name: usingAllowedSELinuxOptions | ||
| expression: | | ||
| has(variables.anyObject.spec.securityContext) && has(variables.anyObject.spec.securityContext.seLinuxOptions) ? |
There was a problem hiding this comment.
This test looks wrong. Shouldn't we be assuming an option is disallowed unless specifically allowed by parameters?
As-written, it looks like undefined parameters => allow everything, which would seem to drift from the rego.
Adding gator tests for this would validate the drift.
There was a problem hiding this comment.
Good catch! I fixed it, it should be in parity with rego now.
|
@sozercan @maxsmythe @ritazh as of now the rego written for policy will deny a pod when disallowed |
Signed-off-by: Jaydip Gabani <[email protected]>
What this PR does / why we need it:
Which issue(s) does this PR fix (optional, using
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when the PR gets merged):Fixes #541
Special notes for your reviewer: