Skip to content

Commit 6a236d5

Browse files
kravciakkravciak
authored
Merge pull request #1251 from kravciak/rego-questions
Add rego policy questions
2 parents de40f2c + 59b2088 commit 6a236d5

4 files changed

Lines changed: 157 additions & 60 deletions

File tree

‎tests/e2e/90-allpolicies.spec.ts‎

Lines changed: 122 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,30 +15,129 @@ type PolicySettings = {
1515
}
1616

1717
const policySettingsMap: Partial<Record<policyTitle, PolicySettings>> = {
18-
'Custom Policy' : { settings: setupCustomPolicy },
19-
'Deprecated API Versions' : { settings: setupDeprecatedAPIVersions },
20-
'Environment Variable Policy': { settings: setupEnvironmentVariablePolicy },
21-
'Namespace label propagator' : { settings: setupNamespaceLabelPropagator },
22-
'PSA Label Enforcer' : { settings: setupPSALabelEnforcer },
23-
'Selinux PSP' : { settings: setupSelinuxPSP },
24-
'Trusted Repos' : { settings: setupTrustedRepos },
25-
'User Group PSP' : { settings: setupUserGroupPSP },
26-
'Verify Image Signatures' : { settings: setupVerifyImageSignatures },
27-
'Container Resources' : { settings: setupContainerResources },
28-
'PVC StorageClass Validator' : { settings: setupPvcScValidator },
29-
'Priority class policy' : { settings: setupPriorityClassPolicy },
30-
'CEL Policy' : { skip: 'https://github.com/kubewarden/cel-policy/issues/12' },
31-
'volumeMounts' : { settings: setupVolumeMounts },
32-
}
33-
34-
async function setupPriorityClassPolicy(ui: RancherUI) {
18+
'Custom Policy' : { settings: setupCustomPolicy },
19+
'Affinity Node Selector' : { settings: affinityNodeSelector },
20+
'Bucket Approved Region' : { settings: generalArray },
21+
'Bucket Endpoint Domain' : { settings: generalArray },
22+
'CEL Policy' : { skip: 'https://github.com/kubewarden/cel-policy/issues/12' },
23+
'Container Resources' : { settings: setupContainerResources },
24+
'Containers Block Specific Image Names' : { settings: generalArray },
25+
'Deprecated API Versions' : { settings: setupDeprecatedAPIVersions },
26+
'Environment Variable Policy' : { settings: generalArray },
27+
'GitRepository Ignore Suffixes' : { settings: generalArray },
28+
'GitRepository Organization Domains' : { settings: generalArray },
29+
'GitRepository Specific Branch' : { settings: gitRepositorySpecificBranch },
30+
'GitRepository Untrusted Domains' : { settings: generalArray },
31+
'Helm Release Service Account Name' : { settings: generalArray },
32+
'Helm Release Storage Namespace' : { settings: generalArray },
33+
'Helm Release Target Namespace' : { settings: generalArray },
34+
'Helm Release Values From' : { settings: generalArray },
35+
'Helm Repo URL Should Be in Organisation Domain' : { settings: generalArray },
36+
'Istio Gateway Approved Hosts' : { settings: generalArray },
37+
'Istio Injected Namespaces' : { settings: generalArray },
38+
'Kustomization Decryption Provider' : { settings: generalArray },
39+
'Kustomization Excluded Paths' : { settings: generalArray },
40+
'Kustomization Images Requirement' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
41+
'Kustomization Patches' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250', settings: kustomizationPatches },
42+
'Kustomization Prune' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250', settings: kustomizationPrune },
43+
'Kustomization Target Namespace' : { settings: generalArray },
44+
'Metadata Missing Label And Value' : { settings: metadataMissingLabelAndValue },
45+
'Namespace Resources Limitrange' : { settings: namespaceResourcesLimitrange },
46+
'Namespace label propagator' : { settings: generalArray },
47+
'Network Allow Egress Traffic From Namespace To Another' : { settings: networkAllowTrafficFromNamespaceToAnother },
48+
'Network Allow Ingress Traffic From Namespace To Another' : { settings: networkAllowTrafficFromNamespaceToAnother },
49+
'Network Block All Ingress Traffic To Namespace From CIDR Block' : { settings: networkBlockAllIngressTrafficToNamespaceFromCIDRBlock },
50+
'OCIRepository Ignore Suffixes' : { settings: generalArray },
51+
'OCIRepository Layer Selector' : { settings: ociRepositoryLayerSelector },
52+
'OCIRepository Organization Domains' : { settings: generalArray },
53+
'OCIRepository Patch Annotation' : { settings: ociRepositoryPatchAnnotation },
54+
'PSA Label Enforcer' : { settings: setupPSALabelEnforcer },
55+
'PVC StorageClass Validator' : { settings: generalArray },
56+
'Persistent Volume Access Modes' : { settings: persistentVolumeAccessModes },
57+
'Persistent Volume Claim Snapshot' : { settings: persistentVolumeClaimSnapshot },
58+
'Priority class policy' : { settings: generalArray },
59+
'Resource Quota Setting Is Missing' : { settings: resourceQuotaSettingIsMissing },
60+
'Resource Suspend Waiver' : { settings: generalArray },
61+
'Selinux PSP' : { settings: setupSelinuxPSP },
62+
'Trusted Repos' : { settings: setupTrustedRepos },
63+
'User Group PSP' : { settings: setupUserGroupPSP },
64+
'Verify Image Signatures' : { settings: setupVerifyImageSignatures },
65+
'volumeMounts' : { settings: setupVolumeMounts },
66+
'Rbac Prohibit Wildcards on Policy Rule Resources' : { skip: 'https://github.com/kubewarden/rego-policies-library/pull/54' },
67+
'Rbac Prohibit Wildcards on Policy Rule Verbs' : { skip: 'https://github.com/kubewarden/rego-policies-library/pull/54' },
68+
'Containers Block Ssh Port' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
69+
'Container Running As User' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
70+
'Helm Release Max History' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
71+
'Helm Release Remediation Retries' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
72+
'Resource Reconcile Interval Must Be Set Between Lower and Upper Bound': { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
73+
'Namespace Pod Quota' : { skip: 'https://github.com/rancher/kubewarden-ui/pull/1250' },
74+
}
75+
76+
async function generalArray(ui: RancherUI) {
3577
await ui.button('Add').click()
36-
await ui.page.getByPlaceholder('e.g. bar').fill('low-priority')
78+
await ui.page.getByPlaceholder('e.g. bar').fill('item')
3779
}
3880

39-
async function setupPvcScValidator(ui: RancherUI) {
40-
await ui.button('Add').click()
41-
await ui.page.getByPlaceholder('e.g. bar').fill('denyname')
81+
async function affinityNodeSelector(ui: RancherUI) {
82+
await ui.input('Key*').fill('node-role.kubernetes.io/control-plane')
83+
await ui.input('Value*').fill('true')
84+
}
85+
86+
async function metadataMissingLabelAndValue(ui: RancherUI) {
87+
await ui.input('Label*').fill('req-label')
88+
await ui.input('Value*').fill('req-value')
89+
}
90+
91+
async function gitRepositorySpecificBranch(ui: RancherUI) {
92+
await ui.input('Branch*').fill('main')
93+
}
94+
95+
async function namespaceResourcesLimitrange(ui: RancherUI) {
96+
await ui.input('Resource type*').fill('cpu')
97+
await ui.input('Resource setting*').fill('default')
98+
}
99+
100+
async function networkAllowTrafficFromNamespaceToAnother(ui: RancherUI) {
101+
await ui.input('Src namespace*').fill('default')
102+
await ui.input('Dst namespace*').fill('kube-system')
103+
}
104+
105+
async function networkBlockAllIngressTrafficToNamespaceFromCIDRBlock(ui: RancherUI) {
106+
await ui.input('Namespace*').fill('default')
107+
await ui.input('Cidr*').fill('cidr')
108+
}
109+
110+
async function ociRepositoryLayerSelector(ui: RancherUI) {
111+
await ui.button('Add').first().click()
112+
await ui.page.getByRole('textbox').first().fill('registry.my-corp.com')
113+
await ui.button('Add').last().click()
114+
await ui.page.getByRole('textbox').last().fill('registry.my-corp.com')
115+
}
116+
117+
async function ociRepositoryPatchAnnotation(ui: RancherUI) {
118+
await ui.input('Provider*').fill('provider')
119+
}
120+
121+
async function persistentVolumeClaimSnapshot(ui: RancherUI) {
122+
await ui.input('Snapshot class*').fill('snapshot-class')
123+
await ui.input('Pvc name*').fill('pvc-name')
124+
}
125+
126+
async function resourceQuotaSettingIsMissing(ui: RancherUI) {
127+
await ui.input('Resource type*').fill('cpu')
128+
}
129+
130+
async function kustomizationPatches(ui: RancherUI) {
131+
await ui.checkbox('Patches required').check()
132+
}
133+
134+
async function kustomizationPrune(ui: RancherUI) {
135+
await ui.checkbox('Prune').check()
136+
}
137+
138+
async function persistentVolumeAccessModes(ui: RancherUI) {
139+
await ui.input('Name*').fill('pvname')
140+
await ui.input('Access mode*').fill('readWriteOnce')
42141
}
43142

44143
async function setupContainerResources(ui: RancherUI) {
@@ -52,11 +151,6 @@ async function setupTrustedRepos(ui: RancherUI) {
52151
await ui.page.getByRole('textbox').last().fill('registry.my-corp.com')
53152
}
54153

55-
async function setupNamespaceLabelPropagator(ui: RancherUI) {
56-
await ui.button('Add').click()
57-
await ui.page.getByRole('textbox').last().fill('cost-center')
58-
}
59-
60154
async function setupPSALabelEnforcer(ui: RancherUI) {
61155
await ui.selectOption('Enforce', 'baseline')
62156
}
@@ -94,16 +188,9 @@ async function setupVerifyImageSignatures(ui: RancherUI) {
94188
})
95189
}
96190

97-
async function setupEnvironmentVariablePolicy(ui: RancherUI) {
98-
await ui.selectOption('Criteria*', 'containsAnyOf')
99-
await ui.button('Add').click()
100-
await ui.page.getByPlaceholder('e.g. bar').fill('reqvar')
101-
}
102-
103191
async function setupUserGroupPSP(ui: RancherUI) {
104-
for (const role of await ui.page.getByRole('combobox').all()) {
105-
role.click()
106-
await ui.page.getByRole('option', { name: 'RunAsAny', exact: true }).click()
192+
for (const rule of await ui.select('Rule').all()) {
193+
await ui.selectOption(rule, 'RunAsAny')
107194
}
108195
}
109196

‎tests/e2e/components/rancher-ui.ts‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ export class RancherUI {
3434
return this.page.locator('div.labeled-input')
3535
.filter({ has: this.page.getByText(label, { exact: true }) })
3636
.locator('input')
37+
.filter({ visible: true })
3738
}
3839

3940
// Labeled Checkbox
@@ -62,15 +63,22 @@ export class RancherUI {
6263
return this.radioGroup(label).getByRole('radio', { name })
6364
}
6465

65-
// Labeled Select (ComboBox)
66-
select(label: string) {
67-
return this.page.locator('div.labeled-select').filter({ hasText: label })
68-
.getByRole('combobox', { name: 'Search for option' })
66+
// (un)Labeled Select (ComboBox)
67+
select(label: string|Locator) {
68+
const base = (typeof label === 'string')
69+
? this.page.locator('div.labeled-select').filter({ hasText: label })
70+
: label.locator('div.unlabeled-select')
71+
72+
return base.getByRole('combobox', { name: 'Search for option' })
6973
}
7074

7175
// Select option from (un)labeled Select
7276
async selectOption(label: string|Locator, option: string | RegExp | number) {
73-
const select = (typeof label === 'string') ? this.select(label) : label.getByRole('combobox', { name: 'Search for option' })
77+
const select = (typeof label === 'string')
78+
? this.select(label)
79+
: (await label.getAttribute('role') === 'combobox')
80+
? label
81+
: this.select(label)
7482
await select.click()
7583

7684
const optionItem = typeof option === 'number'

‎tests/e2e/pages/policies.page.ts‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,25 +4,27 @@ import { TableRow } from '../components/table-row'
44
import { step } from '../rancher/rancher-test'
55
import { BasePage } from '../rancher/basepage'
66

7-
export const apList = ['Custom Policy', 'Allow Privilege Escalation PSP', 'Allowed Fs Groups PSP', 'Allowed Proc Mount Types PSP', 'Apparmor PSP', 'Capabilities PSP', 'CEL Policy',
8-
'Container Resources', 'Affinity Node Selector', 'Containers Block Ssh Port', 'Container Block Sysctls', 'Container Block Sysctls CVE-2022-0811', 'Container Running As Root',
9-
'Container Running As User', 'Containers Block Specific Image Names', 'Missing Kubernetes App Component Label', 'Missing Kubernetes App Created By Label', 'Missing Kubernetes App Instance Label',
10-
'Missing Kubernetes App Label', 'Missing Kubernetes App Managed By Label', 'Missing Kubernetes App Part Of Label', 'Missing Kubernetes App Version Label', 'Metadata Missing Label And Value',
11-
'Block Workloads Created Without Specifying Namespace', 'Missing Owner Label', 'Containers Missing Security Context', 'Containers Should Not Run In Namespace', 'Deprecated API Versions',
12-
'Disallow Service Loadbalancer', 'Disallow Service Nodeport', 'Do not expose admission controller webhook services', 'Echo', 'Environment Variable Secrets Scanner', 'Environment Variable Policy',
13-
'Flexvolume Drivers Psp', 'Bucket Approved Region', 'Bucket Endpoint Domain', 'Bucket Insecure Connections', 'GitRepository Ignore Suffixes', 'GitRepository Organization Domains',
14-
'GitRepository Specific Branch', 'GitRepository Untrusted Domains', 'HelmChart Cosign Verification', 'HelmChart Values File Format', 'Helm Release Max History', 'Helm Release Namespace Match',
15-
'Helm Release Post Renderer', 'Helm Release Remediation Retries', 'Helm Release Rollback Should Be Disabled', 'Helm Release Service Account Name', 'Helm Release Storage Namespace',
16-
'Helm Release Target Namespace', 'Helm Release Values From', 'Helm Repo Type Should Be OCI', 'Helm Repo URL Should Be in Organisation Domain', 'Kustomization Decryption Provider',
17-
'Kustomization Image Tag Standards', 'Kustomization Excluded Paths', 'Kustomization Target Namespace', 'Kustomization Var Substitution', 'Kustomization Images Requirement', 'Kustomization Patches',
18-
'Kustomization Prune', 'OCIRepository Cosign Verification', 'OCIRepository Ignore Suffixes', 'OCIRepository Layer Selector', 'OCIRepository Not Latest Tag', 'OCIRepository Organization Domains',
19-
'OCIRepository Patch Annotation', 'Resource Reconcile Interval Must Be Set Between Lower and Upper Bound', 'Resource Suspend Waiver', 'Host Namespaces PSP', 'Hostpaths PSP', 'Ingress Policy',
20-
'Istio Gateway Approved Hosts', 'Namespace label propagator', 'Namespace Resources Limitrange', 'Namespace Pod Quota', 'Resource Quota Setting Is Missing',
21-
'Network Allow Egress Traffic From Namespace To Another', 'Network Allow Ingress Traffic From Namespace To Another', 'Network Block All Ingress Traffic To Namespace From CIDR Block',
22-
'PVC StorageClass Validator', 'Persistent Volume Claim Snapshot', 'Pod ndots', 'Pod Privileged Policy', 'Pod Runtime', 'Priority class policy', 'Rbac Prohibit List On Secrets',
23-
'Rbac Prohibit Watch On Secrets', 'Rbac Prohibit Wildcard On Secrets', 'Rbac Prohibit Wildcards on Policy Rule Resources', 'Rbac Prohibit Wildcards on Policy Rule Verbs', 'Readonly Root Filesystem PSP',
24-
'Safe Annotations', 'Safe Labels', 'Seccomp PSP', 'Selinux PSP', 'Share PID namespace', 'Sysctl PSP', 'Trusted Repos', 'Unique Ingress host', 'Unique service selector', 'User Group PSP',
25-
'Verify Image Signatures', 'volumeMounts', 'Volumes PSP'] as const
7+
export const apList = ['Custom Policy',
8+
'Affinity Node Selector', 'Allow Privilege Escalation PSP', 'Allowed Fs Groups PSP', 'Allowed Proc Mount Types PSP', 'Apparmor PSP', 'Bucket Approved Region', 'Bucket Endpoint Domain',
9+
'Bucket Insecure Connections', 'Capabilities PSP', 'CEL Policy', 'Container Block Sysctls', 'Container Block Sysctls CVE-2022-0811', 'Container Resources', 'Container Running As Root',
10+
'Container Running As User', 'Containers Block Ssh Port', 'Containers Block Specific Image Names', 'Containers Missing Security Context', 'Containers Should Not Run In Namespace',
11+
'Deprecated API Versions', 'Disallow Service Loadbalancer', 'Disallow Service Nodeport', 'Do not expose admission controller webhook services', 'Echo', 'Environment Variable Policy',
12+
'Environment Variable Secrets Scanner', 'Flexvolume Drivers Psp', 'GitRepository Ignore Suffixes', 'GitRepository Organization Domains', 'GitRepository Specific Branch',
13+
'GitRepository Untrusted Domains', 'Helm Release Max History', 'Helm Release Namespace Match', 'Helm Release Post Renderer', 'Helm Release Remediation Retries',
14+
'Helm Release Rollback Should Be Disabled', 'Helm Release Service Account Name', 'Helm Release Storage Namespace', 'Helm Release Target Namespace', 'Helm Release Values From',
15+
'Helm Repo Type Should Be OCI', 'Helm Repo URL Should Be in Organisation Domain', 'HelmChart Cosign Verification', 'HelmChart Values File Format', 'Host Namespaces PSP',
16+
'Hostpaths PSP', 'Ingress Policy', 'Istio Gateway Approved Hosts', 'Kustomization Decryption Provider', 'Kustomization Excluded Paths', 'Kustomization Image Tag Standards',
17+
'Kustomization Images Requirement', 'Kustomization Patches', 'Kustomization Prune', 'Kustomization Target Namespace', 'Kustomization Var Substitution',
18+
'Metadata Missing Label And Value', 'Missing Kubernetes App Component Label', 'Missing Kubernetes App Created By Label', 'Missing Kubernetes App Instance Label',
19+
'Missing Kubernetes App Label', 'Missing Kubernetes App Managed By Label', 'Missing Kubernetes App Part Of Label', 'Missing Kubernetes App Version Label',
20+
'Missing Owner Label', 'Namespace Pod Quota', 'Namespace Resources Limitrange', 'Namespace label propagator', 'Network Allow Egress Traffic From Namespace To Another',
21+
'Network Allow Ingress Traffic From Namespace To Another', 'Network Block All Ingress Traffic To Namespace From CIDR Block', 'OCIRepository Cosign Verification',
22+
'OCIRepository Ignore Suffixes', 'OCIRepository Layer Selector', 'OCIRepository Not Latest Tag', 'OCIRepository Organization Domains', 'OCIRepository Patch Annotation',
23+
'PVC StorageClass Validator', 'Persistent Volume Claim Snapshot', 'Pod Privileged Policy', 'Pod Runtime', 'Pod ndots', 'Priority class policy', 'Rbac Prohibit List On Secrets',
24+
'Rbac Prohibit Watch On Secrets', 'Rbac Prohibit Wildcard On Secrets', 'Rbac Prohibit Wildcards on Policy Rule Resources', 'Rbac Prohibit Wildcards on Policy Rule Verbs',
25+
'Readonly Root Filesystem PSP', 'Resource Quota Setting Is Missing', 'Resource Reconcile Interval Must Be Set Between Lower and Upper Bound', 'Resource Suspend Waiver',
26+
'Safe Annotations', 'Safe Labels', 'Seccomp PSP', 'Selinux PSP', 'Share PID namespace', 'Sysctl PSP', 'Trusted Repos', 'Unique Ingress host', 'Unique service selector',
27+
'User Group PSP', 'Verify Image Signatures', 'Volumes PSP', 'volumeMounts'] as const
2628

2729
export const capList = [...apList, 'PSA Label Enforcer', 'Istio Injected Namespaces', 'Persistent Volume Access Modes'] as const
2830

‎tests/e2e/rancher/rancher-fleet.page.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ export class RancherFleetPage extends BasePage {
2828
}
2929

3030
async selectWorkspace(workspace: string) {
31-
await this.ui.selectOption(this.page.locator('.rd-header-right').locator('.unlabeled-select'), workspace)
31+
await this.ui.selectOption(this.page.getByTestId('workspace-switcher'), workspace)
3232
}
3333

3434
@step

0 commit comments

Comments
 (0)