fix chainsaw tests

Signed-off-by: Mariam Fahmy <[email protected]>

pod-security-cel/restricted/disallow-capabilities-strict/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: disallow-capabilities-strict
+spec:
+  steps:
+  - name: step-01
+    try:
+    - script:
+        content: |
+          sed 's/validationFailureAction: Audit/validationFailureAction: Enforce/' ../disallow-capabilities-strict.yaml | kubectl create -f -
+    - assert:
+        file: ../../../../pod-security/restricted/disallow-capabilities-strict/.chainsaw-test/chainsaw-step-01-assert-1.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: ../../../../pod-security/restricted/disallow-capabilities-strict/.chainsaw-test/pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/disallow-capabilities-strict/.chainsaw-test/pod-bad.yaml
+    - apply:
+        file: ../../../../pod-security/restricted/disallow-capabilities-strict/.chainsaw-test/podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/disallow-capabilities-strict/.chainsaw-test/podcontroller-bad.yaml
+  - name: step-99
+    try:
+    - delete:
+        ref:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          name: disallow-capabilities-strict

pod-security-cel/restricted/disallow-capabilities-strict/kyverno-test.yaml → pod-security-cel/restricted/disallow-capabilities-strict/.kyverno-test/kyverno-test.yaml

@@ -3,9 +3,9 @@ kind: Test
 metadata:
   name: disallow-capabilities-strict
 policies:
-- disallow-capabilities-strict.yaml
+- ../disallow-capabilities-strict.yaml
 resources:
-- ../../../pod-security/restricted/disallow-capabilities-strict/resource.yaml
+- ../../../../pod-security/restricted/disallow-capabilities-strict/.kyverno-test/resource.yaml
 results:
 - kind: CronJob
   policy: disallow-capabilities-strict

pod-security-cel/restricted/disallow-privilege-escalation/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: disallow-privilege-escalation
+spec:
+  steps:
+  - name: step-01
+    try:
+    - script:
+        content: |
+          sed 's/validationFailureAction: Audit/validationFailureAction: Enforce/' ../disallow-privilege-escalation.yaml | kubectl create -f -
+    - assert:
+        file: ../../../../pod-security/restricted/disallow-privilege-escalation/.chainsaw-test/chainsaw-step-01-assert-1.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: ../../../../pod-security/restricted/disallow-privilege-escalation/.chainsaw-test/pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/disallow-privilege-escalation/.chainsaw-test/pod-bad.yaml
+    - apply:
+        file: ../../../../pod-security/restricted/disallow-privilege-escalation/.chainsaw-test/podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/disallow-privilege-escalation/.chainsaw-test/podcontroller-bad.yaml
+  - name: step-99
+    try:
+    - delete:
+        ref:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          name: disallow-privilege-escalation

pod-security-cel/restricted/disallow-privilege-escalation/kyverno-test.yaml → pod-security-cel/restricted/disallow-privilege-escalation/.kyverno-test/kyverno-test.yaml

@@ -3,9 +3,9 @@ kind: Test
 metadata:
   name: disallow-privilege-escalation
 policies:
-- disallow-privilege-escalation.yaml
+- ../disallow-privilege-escalation.yaml
 resources:
-- ../../../pod-security/restricted/disallow-privilege-escalation/resource.yaml
+- ../../../../pod-security/restricted/disallow-privilege-escalation/.kyverno-test/resource.yaml
 results:
 - kind: CronJob
   policy: disallow-privilege-escalation

pod-security-cel/restricted/require-run-as-non-root-user/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: require-run-as-non-root-user
+spec:
+  steps:
+  - name: step-01
+    try:
+    - script:
+        content: |
+          sed 's/validationFailureAction: Audit/validationFailureAction: Enforce/' ../require-run-as-non-root-user.yaml | kubectl create -f -
+    - assert:
+        file: ../../../../pod-security/restricted/require-run-as-non-root-user/.chainsaw-test/chainsaw-step-01-assert-1.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: ../../../../pod-security/restricted/require-run-as-non-root-user/.chainsaw-test/pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/require-run-as-non-root-user/.chainsaw-test/pod-bad.yaml
+    - apply:
+        file: ../../../../pod-security/restricted/require-run-as-non-root-user/.chainsaw-test/podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/require-run-as-non-root-user/.chainsaw-test/podcontroller-bad.yaml
+  - name: step-99
+    try:
+    - delete:
+        ref:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          name: require-run-as-non-root-user

pod-security-cel/restricted/require-run-as-non-root-user/kyverno-test.yaml → pod-security-cel/restricted/require-run-as-non-root-user/.kyverno-test/kyverno-test.yaml

@@ -3,9 +3,9 @@ kind: Test
 metadata:
   name: require-run-as-non-root-user
 policies:
-- require-run-as-non-root-user.yaml
+- ../require-run-as-non-root-user.yaml
 resources:
-- ../../../pod-security/restricted/require-run-as-non-root-user/resource.yaml
+- ../../../../pod-security/restricted/require-run-as-non-root-user/.kyverno-test/resource.yaml
 results:
 - kind: CronJob
   policy: require-run-as-non-root-user

pod-security-cel/restricted/restrict-seccomp-strict/.chainsaw-test.yaml/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: restrict-seccomp-strict
+spec:
+  steps:
+  - name: step-01
+    try:
+    - script:
+        content: |
+          sed 's/validationFailureAction: Audit/validationFailureAction: Enforce/' ../restrict-seccomp-strict.yaml | kubectl create -f -
+    - assert:
+        file: ../../../../pod-security/restricted/restrict-seccomp-strict/.chainsaw-test/chainsaw-step-01-assert-1.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: ../../../../pod-security/restricted/restrict-seccomp-strict/.chainsaw-test/pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/restrict-seccomp-strict/.chainsaw-test/pod-bad.yaml
+    - apply:
+        file: ../../../../pod-security/restricted/restrict-seccomp-strict/.chainsaw-test/podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/restrict-seccomp-strict/.chainsaw-test/podcontroller-bad.yaml
+  - name: step-99
+    try:
+    - delete:
+        ref:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          name: restrict-seccomp-strict

pod-security-cel/restricted/restrict-seccomp-strict/kyverno-test.yaml → pod-security-cel/restricted/restrict-seccomp-strict/.kyverno-test.yaml/kyverno-test.yaml

@@ -3,9 +3,9 @@ kind: Test
 metadata:
   name: restrict-seccomp-strict
 policies:
-- restrict-seccomp-strict.yaml
+- ../restrict-seccomp-strict.yaml
 resources:
-- ../../../pod-security/restricted/restrict-seccomp-strict/resource.yaml
+- ../../../../pod-security/restricted/restrict-seccomp-strict/.kyverno-test/resource.yaml
 results:
 - kind: CronJob
   policy: restrict-seccomp-strict

pod-security-cel/restricted/restrict-volume-types/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,49 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: restrict-volume-types
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: ns.yaml
+    - script:
+        content: |
+          sed 's/validationFailureAction: Audit/validationFailureAction: Enforce/' ../restrict-volume-types.yaml | kubectl create -f -
+    - assert:
+        file: ../../../../pod-security/restricted/restrict-volume-types/.chainsaw-test/chainsaw-step-01-assert-1.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: ../../../../pod-security/restricted/restrict-volume-types/.chainsaw-test/pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/restrict-volume-types/.chainsaw-test/pod-bad.yaml
+    - apply:
+        file: ../../../../pod-security/restricted/restrict-volume-types/.chainsaw-test/podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ../../../../pod-security/restricted/restrict-volume-types/.chainsaw-test/podcontroller-bad.yaml
+  - name: step-99
+    try:
+    - delete:
+        ref:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          name: restrict-volume-types
+    - command:
+        args:
+        - delete
+        - all
+        - --all
+        - --force
+        - --grace-period=0
+        - -n
+        - restrict-voltypes-ns
+        entrypoint: kubectl

pod-security-cel/restricted/restrict-volume-types/kyverno-test.yaml → pod-security-cel/restricted/restrict-volume-types/.kyverno-test/kyverno-test.yaml

@@ -3,9 +3,9 @@ kind: Test
 metadata:
   name: restrict-volume-types
 policies:
-- restrict-volume-types.yaml
+- ../restrict-volume-types.yaml
 resources:
-- ../../../pod-security/restricted/restrict-volume-types/resource.yaml
+- ../../../../pod-security/restricted/restrict-volume-types/.kyverno-test/resource.yaml
 results:
 - kind: CronJob
   policy: restrict-volume-types