disallow-proc-mount: add chainsaw test

Signed-off-by: Mohamed Awnallah <[email protected]>

pod-security/baseline/disallow-proc-mount/.chainsaw-test/chainsaw-step-01-assert-1.yaml

@@ -0,0 +1,6 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-proc-mount
+status:
+  ready: true

pod-security/baseline/disallow-proc-mount/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,38 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: disallow-proc-mount
+spec:
+  steps:
+  - name: step-01
+    try:
+      - apply:
+          file: ../disallow-proc-mount.yaml
+      - patch:
+          resource:
+            apiVersion: kyverno.io/v1
+            kind: ClusterPolicy
+            metadata:
+              name: disallow-proc-mount
+            spec:
+              validationFailureAction: Enforce
+      - assert:
+          file: chainsaw-step-01-assert-1.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: valid-pod.yaml
+  - name: step-03
+    try:
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: invalid-pod-containers.yaml
+  - name: step-04
+    try:
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: invalid-pod-initcontainers.yaml

pod-security/baseline/disallow-proc-mount/.chainsaw-test/invalid-pod-containers.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: invalid-pod-containers
+spec:
+  containers:
+    - name: invalid-container
+      image: nginx:1.14.1
+      securityContext:
+        procMount: Unmasked
+  initContainers:
+    - name: valid-init-container
+      image: busybox:1.35
+      securityContext:
+        procMount: Default

pod-security/baseline/disallow-proc-mount/.chainsaw-test/invalid-pod-initcontainers.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: invalid-pod-initcontainers
+spec:
+  containers:
+    - name: valid-container
+      image: nginx:1.14.1
+      securityContext:
+        procMount: Default
+  initContainers:
+    - name: invalid-init-container
+      image: busybox:1.35
+      securityContext:
+        procMount: Unmasked

pod-security/baseline/disallow-proc-mount/.chainsaw-test/valid-pod.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: valid-pod
+spec:
+  containers:
+    - name: valid-container
+      image: nginx:1.14.1
+      securityContext:
+        procMount: Default
+  initContainers:
+    - name: valid-init-container
+      image: busybox:1.35
+      securityContext:
+        procMount: Default