Skip to content

Commit a5dc8e0

Browse files
patrick-hermann-svapatrick-hermann-sva
committed
feat: feat/add-kyverno
1 parent 14a50f5 commit a5dc8e0

14 files changed

+342
-4
lines changed

‎README.md

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,35 @@ collection of dagger modules.
44

55
## MODULES
66

7+
<details><summary><b>KYVERNO</b></summary>
8+
9+
```bash
10+
# VALIDATE RESOURCES AGAINST POLICIES
11+
dagger call -m kyverno validate \
12+
--policy tests/kyverno/policies/ \
13+
--resource tests/kyverno/resource-good/ \
14+
--progress plain
15+
```
16+
17+
```bash
18+
# OUTPUT KYVERNO VERSION
19+
dagger call -m kyverno version \
20+
--progress plain
21+
```
22+
23+
</details>
24+
725
<details><summary><b>GITLAB</b></summary>
826

27+
```bash
28+
# GET PROJECT ID BY PROJECT NAME
29+
dagger call -m gitlab get-project-id \
30+
--token env:GITLAB_TOKEN \
31+
--server gitlab.com \
32+
--project-name "Lab/stuttgart-things/idp/resource-engines" \
33+
--progress plain
34+
```
35+
936
```bash
1037
# GET MERGE REQUEST ID BY PROJECT ID
1138
dagger call -m gitlab list-merge-requests \
@@ -69,8 +96,6 @@ dagger call -m gitlab update-merge-request-state \
6996

7097
</details>
7198

72-
73-
7499
<details><summary><b>CRANE</b></summary>
75100

76101
```bash

‎gitlab/clone.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
// ClonePrivateRepo clones a private repository and returns a Dagger Directory
1111

1212
// Clone clones a git repo using a container and returns the Directory
13-
func (g *Gitlab) Clone(
13+
func (g *Gitlab) CloneWithToken(
1414
ctx context.Context,
1515
repoURL string,
1616
token dagger.Secret,

‎gitlab/mr.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ func (g *Gitlab) PrintMergeRequestFileChanges(
157157
) error {
158158

159159
// 1. Clone the repo
160-
repoDir, err := g.Clone(ctx, repoURL, token, branch)
160+
repoDir, err := g.CloneWithToken(ctx, repoURL, token, branch)
161161
if err != nil {
162162
return fmt.Errorf("failed to clone repo: %w", err)
163163
}

‎kyverno/.gitattributes

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
/dagger.gen.go linguist-generated
2+
/internal/dagger/** linguist-generated
3+
/internal/querybuilder/** linguist-generated
4+
/internal/telemetry/** linguist-generated

‎kyverno/.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
/dagger.gen.go
2+
/internal/dagger
3+
/internal/querybuilder
4+
/internal/telemetry

‎kyverno/dagger.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name": "kyverno",
3+
"engineVersion": "v0.18.3",
4+
"sdk": {
5+
"source": "go"
6+
},
7+
"source": "."
8+
}

‎kyverno/go.mod

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
module dagger/kyverno
2+
3+
go 1.23.6
4+
5+
require (
6+
github.com/99designs/gqlgen v0.17.70
7+
github.com/Khan/genqlient v0.8.0
8+
github.com/vektah/gqlparser/v2 v2.5.23
9+
go.opentelemetry.io/otel v1.34.0
10+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0
11+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0
12+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0
13+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0
14+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0
15+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0
16+
go.opentelemetry.io/otel/log v0.8.0
17+
go.opentelemetry.io/otel/metric v1.34.0
18+
go.opentelemetry.io/otel/sdk v1.34.0
19+
go.opentelemetry.io/otel/sdk/log v0.8.0
20+
go.opentelemetry.io/otel/sdk/metric v1.34.0
21+
go.opentelemetry.io/otel/trace v1.34.0
22+
go.opentelemetry.io/proto/otlp v1.3.1
23+
golang.org/x/sync v0.12.0
24+
google.golang.org/grpc v1.71.0
25+
)
26+
27+
require (
28+
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
29+
github.com/go-logr/logr v1.4.2 // indirect
30+
github.com/go-logr/stdr v1.2.2 // indirect
31+
github.com/google/uuid v1.6.0 // indirect
32+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 // indirect
33+
github.com/sosodev/duration v1.3.1 // indirect
34+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
35+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 // indirect
36+
golang.org/x/net v0.38.0 // indirect
37+
golang.org/x/sys v0.31.0 // indirect
38+
golang.org/x/text v0.23.0 // indirect
39+
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect
40+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
41+
google.golang.org/protobuf v1.36.6 // indirect
42+
)
43+
44+
replace go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc => go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0
45+
46+
replace go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp => go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0
47+
48+
replace go.opentelemetry.io/otel/log => go.opentelemetry.io/otel/log v0.8.0
49+
50+
replace go.opentelemetry.io/otel/sdk/log => go.opentelemetry.io/otel/sdk/log v0.8.0

‎kyverno/go.sum

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
github.com/99designs/gqlgen v0.17.70 h1:xgLIgQuG+Q2L/AE9cW595CT7xCWCe/bpPIFGSfsGSGs=
2+
github.com/99designs/gqlgen v0.17.70/go.mod h1:fvCiqQAu2VLhKXez2xFvLmE47QgAPf/KTPN5XQ4rsHQ=
3+
github.com/Khan/genqlient v0.8.0 h1:Hd1a+E1CQHYbMEKakIkvBH3zW0PWEeiX6Hp1i2kP2WE=
4+
github.com/Khan/genqlient v0.8.0/go.mod h1:hn70SpYjWteRGvxTwo0kfaqg4wxvndECGkfa1fdDdYI=
5+
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
6+
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
7+
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
8+
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
9+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
10+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
11+
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
12+
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
13+
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
14+
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
15+
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
16+
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
17+
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
18+
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
19+
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
20+
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
21+
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
22+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 h1:ad0vkEBuk23VJzZR9nkLVG0YAoN9coASF1GusYX6AlU=
23+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0/go.mod h1:igFoXX2ELCW06bol23DWPB5BEWfZISOzSP5K2sbLea0=
24+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
25+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
26+
github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
27+
github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
28+
github.com/sosodev/duration v1.3.1 h1:qtHBDMQ6lvMQsL15g4aopM4HEfOaYuhWBw3NPTtlqq4=
29+
github.com/sosodev/duration v1.3.1/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
30+
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
31+
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
32+
github.com/vektah/gqlparser/v2 v2.5.23 h1:PurJ9wpgEVB7tty1seRUwkIDa/QH5RzkzraiKIjKLfA=
33+
github.com/vektah/gqlparser/v2 v2.5.23/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
34+
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
35+
go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
36+
go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
37+
go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
38+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
39+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
40+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
41+
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0/go.mod h1:5KXybFvPGds3QinJWQT7pmXf+TN5YIa7CNYObWRkj50=
42+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7ZSD+5yn+lo3sGV69nW04rRR0jhYnBwjuX3r0HvnK0=
43+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
44+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
45+
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
46+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 h1:IJFEoHiytixx8cMiVAO+GmHR6Frwu+u5Ur8njpFO6Ac=
47+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0/go.mod h1:3rHrKNtLIoS0oZwkY2vxi+oJcwFRWdtUyRII+so45p8=
48+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0 h1:9kV11HXBHZAvuPUZxmMWrH8hZn/6UnHX4K0mu36vNsU=
49+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0/go.mod h1:JyA0FHXe22E1NeNiHmVp7kFHglnexDQ7uRWDiiJ1hKQ=
50+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
51+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
52+
go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
53+
go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
54+
go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
55+
go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
56+
go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
57+
go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
58+
go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
59+
go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
60+
go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
61+
go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
62+
go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
63+
go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
64+
go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
65+
go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
66+
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
67+
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
68+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
69+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
70+
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
71+
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
72+
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
73+
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
74+
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
75+
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
76+
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24=
77+
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
78+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI=
79+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
80+
google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
81+
google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
82+
google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
83+
google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
84+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
85+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎kyverno/main.go

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
// A generated module for Kyverno functions
2+
//
3+
// This module has been generated via dagger init and serves as a reference to
4+
// basic module structure as you get started with Dagger.
5+
//
6+
// Two functions have been pre-created. You can modify, delete, or add to them,
7+
// as needed. They demonstrate usage of arguments and return types using simple
8+
// echo and grep commands. The functions can be called from the dagger CLI or
9+
// from one of the SDKs.
10+
//
11+
// The first line in this comment block is a short description line and the
12+
// rest is a long description with more detail on the module's purpose or usage,
13+
// if appropriate. All modules should have a short description.
14+
15+
package main
16+
17+
import (
18+
"context"
19+
"dagger/kyverno/internal/dagger"
20+
"fmt"
21+
)
22+
23+
type Kyverno struct {
24+
// Base Wolfi image to use
25+
// +optional
26+
// +default="cgr.dev/chainguard/wolfi-base:latest"
27+
BaseImage string
28+
}
29+
30+
func (m *Kyverno) Validate(
31+
ctx context.Context,
32+
policy *dagger.Directory,
33+
resource *dagger.Directory,
34+
) error {
35+
kyverno := m.container().
36+
WithMountedDirectory("/policy", policy).
37+
WithMountedDirectory("/resource", resource).
38+
WithWorkdir("/")
39+
40+
result, err := kyverno.
41+
WithExec([]string{"kubectl-kyverno", "apply", "/policy", "--resource", "/resource"}).
42+
Stdout(ctx)
43+
44+
if err != nil {
45+
return fmt.Errorf("failed to validate: %w", err)
46+
}
47+
48+
fmt.Println(result)
49+
return nil
50+
}
51+
52+
func (m *Kyverno) Version(
53+
ctx context.Context) (version string) {
54+
kyverno := m.container()
55+
56+
cmd := []string{"kubectl-kyverno", "version"}
57+
58+
version, err := kyverno.WithExec(cmd).Stdout(ctx)
59+
if err != nil {
60+
fmt.Println("Error running kyverno version: ", err)
61+
return
62+
}
63+
fmt.Println("Kyverno version: ", version)
64+
65+
return version
66+
}
67+
68+
func (m *Kyverno) container() *dagger.Container {
69+
if m.BaseImage == "" {
70+
m.BaseImage = "cgr.dev/chainguard/wolfi-base:latest"
71+
}
72+
73+
ctr := dag.Container().From(m.BaseImage)
74+
75+
pkg := "kyverno-cli"
76+
ctr = ctr.WithExec([]string{"apk", "add", "--no-cache", pkg})
77+
ctr = ctr.WithEntrypoint([]string{"kubectl-kyverno"})
78+
79+
return ctr
80+
}

‎tests/kyverno/policies/disallow-latest-tag.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# policies/disallow-latest-tag.yaml
2+
apiVersion: kyverno.io/v1
3+
kind: ClusterPolicy
4+
metadata:
5+
name: disallow-latest-tag
6+
spec:
7+
validationFailureAction: enforce
8+
rules:
9+
- name: no-latest-tag
10+
match:
11+
resources:
12+
kinds:
13+
- Pod
14+
validate:
15+
message: "Using 'latest' tag is not allowed."
16+
pattern:
17+
spec:
18+
containers:
19+
- image: "!*:latest"

‎tests/kyverno/policies/require-pod-label.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# policies/require-pod-label.yaml
2+
apiVersion: kyverno.io/v1
3+
kind: ClusterPolicy
4+
metadata:
5+
name: require-pod-label
6+
spec:
7+
validationFailureAction: enforce
8+
rules:
9+
- name: check-for-required-label
10+
match:
11+
resources:
12+
kinds:
13+
- Pod
14+
validate:
15+
message: "Pods must have the label 'app'."
16+
pattern:
17+
metadata:
18+
labels:
19+
app: "?*"

‎tests/kyverno/policies/restrict-privileged-containers.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# policies/restrict-privileged-containers.yaml
2+
apiVersion: kyverno.io/v1
3+
kind: ClusterPolicy
4+
metadata:
5+
name: restrict-privileged
6+
spec:
7+
validationFailureAction: enforce
8+
rules:
9+
- name: disallow-privileged
10+
match:
11+
resources:
12+
kinds:
13+
- Pod
14+
validate:
15+
message: "Privileged containers are not allowed."
16+
pattern:
17+
spec:
18+
containers:
19+
- securityContext:
20+
privileged: "false"

‎tests/kyverno/resource-bad/pod-bad.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# resources/pod-bad.yaml
2+
apiVersion: v1
3+
kind: Pod
4+
metadata:
5+
name: bad-pod
6+
spec:
7+
containers:
8+
- name: nginx
9+
image: nginx:latest
10+
securityContext:
11+
privileged: true

‎tests/kyverno/resource-good/pod-good.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# resources/pod-good.yaml
2+
apiVersion: v1
3+
kind: Pod
4+
metadata:
5+
name: good-pod
6+
labels:
7+
app: myapp
8+
spec:
9+
containers:
10+
- name: nginx
11+
image: nginx:1.25
12+
securityContext:
13+
privileged: false

0 commit comments

Comments
 (0)