-
Notifications
You must be signed in to change notification settings - Fork 197
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
test(operator): Assert that ConfigAuditReports are created when Conft…
…est is used as a scanner (#556) Resolves: #480 Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>
- Loading branch information
1 parent
66cf6a2
commit b2d8284
Showing
10 changed files
with
304 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| <component name="ProjectRunConfigurationManager"> | ||
| <configuration default="false" name="Integration / Operator / Conftest" type="GoTestRunConfiguration" factoryName="Go Test"> | ||
| <module name="starboard" /> | ||
| <working_directory value="$PROJECT_DIR$/itest/starboard-operator/configauditreport/conftest" /> | ||
| <envs> | ||
| <env name="OPERATOR_NAMESPACE" value="starboard-operator" /> | ||
| <env name="OPERATOR_TARGET_NAMESPACES" value="default" /> | ||
| </envs> | ||
| <root_directory value="$PROJECT_DIR$" /> | ||
| <kind value="PACKAGE" /> | ||
| <package value="github.com/aquasecurity/starboard/itest/starboard-operator/configauditreport/conftest" /> | ||
| <directory value="$PROJECT_DIR$" /> | ||
| <filePath value="$PROJECT_DIR$" /> | ||
| <framework value="gotest" /> | ||
| <pattern value="^\QTestIntegrationOperatorWithConftest\E$" /> | ||
| <method v="2" /> | ||
| </configuration> | ||
| </component> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 8 additions & 0 deletions
8
itest/starboard-operator/configauditreport/conftest/a_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| package conftest | ||
|
|
||
| import ( | ||
| . "github.com/aquasecurity/starboard/itest/starboard-operator/behavior" | ||
| . "github.com/onsi/ginkgo" | ||
| ) | ||
|
|
||
| var _ = Describe("Conftest", ConfigurationCheckerBehavior(&inputs)) |
133 changes: 133 additions & 0 deletions
133
itest/starboard-operator/configauditreport/conftest/suite_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,133 @@ | ||
| package conftest | ||
|
|
||
| import ( | ||
| _ "embed" | ||
|
|
||
| . "github.com/onsi/ginkgo" | ||
| . "github.com/onsi/gomega" | ||
|
|
||
| "context" | ||
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/aquasecurity/starboard/itest/helper" | ||
| "github.com/aquasecurity/starboard/itest/starboard-operator/behavior" | ||
| "github.com/aquasecurity/starboard/pkg/operator" | ||
| "github.com/aquasecurity/starboard/pkg/operator/etc" | ||
| "github.com/aquasecurity/starboard/pkg/starboard" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| logf "sigs.k8s.io/controller-runtime/pkg/log" | ||
| "sigs.k8s.io/controller-runtime/pkg/log/zap" | ||
| ) | ||
|
|
||
| var ( | ||
| buildInfo = starboard.BuildInfo{ | ||
| Version: "dev", | ||
| Commit: "none", | ||
| Date: "unknown", | ||
| } | ||
| ) | ||
|
|
||
| var ( | ||
| scheme *runtime.Scheme | ||
| kubeClient client.Client | ||
| startCtx context.Context | ||
| stopFunc context.CancelFunc | ||
| ) | ||
|
|
||
| var ( | ||
| inputs behavior.Inputs | ||
| ) | ||
|
|
||
| var ( | ||
| starboardCM *corev1.ConfigMap | ||
| conftestCM *corev1.ConfigMap | ||
|
|
||
| //go:embed testdata/run_as_root.rego | ||
| runAsRootPolicy string | ||
| ) | ||
|
|
||
| func TestIntegrationOperatorWithConftest(t *testing.T) { | ||
| if testing.Short() { | ||
| t.Skip("Skipping integration test") | ||
| } | ||
| RegisterFailHandler(Fail) | ||
| RunSpecs(t, "Conftest") | ||
| } | ||
|
|
||
| var _ = BeforeSuite(func() { | ||
| operatorConfig, err := etc.GetOperatorConfig() | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(operatorConfig.LogDevMode))) | ||
|
|
||
| kubeConfig, err := ctrl.GetConfig() | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| scheme = starboard.NewScheme() | ||
| kubeClient, err = client.New(kubeConfig, client.Options{ | ||
| Scheme: scheme, | ||
| }) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| inputs = behavior.Inputs{ | ||
| AssertTimeout: 3 * time.Minute, | ||
| PrimaryNamespace: corev1.NamespaceDefault, | ||
| PrimaryWorkloadPrefix: "wordpress", | ||
|
|
||
| Client: kubeClient, | ||
| Helper: helper.NewHelper(scheme, kubeClient), | ||
| } | ||
|
|
||
| // We can disable vulnerability scanner and CIS benchmarks | ||
| operatorConfig.VulnerabilityScannerEnabled = false | ||
| operatorConfig.CISKubernetesBenchmarkEnabled = false | ||
|
|
||
| starboardCM = &corev1.ConfigMap{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Namespace: operatorConfig.Namespace, | ||
| Name: starboard.ConfigMapName, | ||
| }, | ||
| Data: map[string]string{ | ||
| "configAuditReports.scanner": "Conftest", | ||
| "conftest.imageRef": "docker.io/openpolicyagent/conftest:v0.23.0", | ||
| }, | ||
| } | ||
| err = kubeClient.Create(context.Background(), starboardCM) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| conftestCM = &corev1.ConfigMap{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Namespace: operatorConfig.Namespace, | ||
| Name: starboard.GetPluginConfigMapName("Conftest"), | ||
| }, | ||
| Data: map[string]string{ | ||
| "conftest.policy.runs_as_root.rego": runAsRootPolicy, | ||
| }, | ||
| } | ||
| err = kubeClient.Create(context.Background(), conftestCM) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
|
|
||
| startCtx, stopFunc = context.WithCancel(context.Background()) | ||
|
|
||
| go func() { | ||
| defer GinkgoRecover() | ||
| By("Starting Starboard operator") | ||
| err = operator.Start(startCtx, buildInfo, operatorConfig) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| }() | ||
|
|
||
| }) | ||
|
|
||
| var _ = AfterSuite(func() { | ||
| By("Stopping Starboard operator") | ||
| stopFunc() | ||
| err := kubeClient.Delete(context.Background(), starboardCM) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| err = kubeClient.Delete(context.Background(), conftestCM) | ||
| Expect(err).ToNot(HaveOccurred()) | ||
| }) |
31 changes: 31 additions & 0 deletions
31
itest/starboard-operator/configauditreport/conftest/testdata/run_as_root.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| package main | ||
|
|
||
| deny[res] { | ||
| input.kind == "ReplicaSet" | ||
| not input.spec.template.spec.securityContext.runAsNonRoot | ||
|
|
||
| res := { | ||
| "msg": "Containers must not run as root", | ||
| "title": "Run as root" | ||
| } | ||
| } | ||
|
|
||
| deny[res] { | ||
| input.kind == "Pod" | ||
| not input.spec.securityContext.runAsNonRoot | ||
|
|
||
| res := { | ||
| "msg": "Containers must not run as root", | ||
| "title": "Run as root" | ||
| } | ||
| } | ||
|
|
||
| deny[res] { | ||
| input.kind == "CronJob" | ||
| not input.spec.jobTemplate.spec.template.spec.securityContext.runAsNonRoot | ||
|
|
||
| res := { | ||
| "msg": "Containers must not run as root", | ||
| "title": "Run as root" | ||
| } | ||
| } |
Oops, something went wrong.