search

confidential-containers / cloud-api-adaptor

Ability to create Kata pods using cloud provider APIs aka the peer-pods approach
Apache License 2.0
44 stars 71 forks source link

test/e2e: libvirt: Add policy tests #1876

Open stevenhorsman opened 1 week ago

stevenhorsman commented 1 week ago

Add policy tests for two scenarios:

Scenario: Block exec command Given a peer pods set-up including the "latest" kata-containers main codebase and a pod created, which includes the annotation io.katacontainers.config.agent.policy: which is set to the base64 encoded allow-all-except-exec-process.rego When we run kubectl exec <pod_name> -- <command> Then The request is blocked with an error that includes: failed to exec in container and ExecProcessRequest is blocked by policy

Scenario: Fully permission policy Given a peer pods set-up including the "latest" kata-containers main codebase and a pod created, which includes the annotation io.katacontainers.config.agent.policy: which is set to the base64 encoded allow-all.rego When we run kubectl exec <pod_name> -- <command> Then The request is successful

stevenhorsman commented 1 week ago

I'll put a hold on this as we expect it to fail with the 0.9.0-alpha1 release due to the required kata runtime changes not being in the 3.6.0 that the release uses.