Merge pull request #156 from nirmata/kyverno-cel-policy

Updated the kyverno cel policies included the create and update operations
nirmata · Sep 6, 2024 · 1094f7f · 1094f7f
2 parents 29805bd + 281bc72
commit 1094f7f
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 4 deletions.
diff --git a/.github/workflows/chainsaw-e2e.yaml b/.github/workflows/chainsaw-e2e.yaml
@@ -16,7 +16,7 @@ jobs:
       fail-fast: false    
       matrix:
         k8s-version: [v1.30.0, v1.29.4, v1.28.9]
-        n4k-chart-version: [3.0.30]
+        n4k-chart-version: [3.0.31]
 
     steps:
       - name: Checkout
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false    
       matrix:
         k8s-version: [v1.30.0, v1.29.4, v1.28.9]
-        n4k-chart-version: [3.1.18, 3.2.2-rc3]
+        n4k-chart-version: [3.1.18, 3.2.2]
 
     steps:
       - name: Checkout
@@ -92,7 +92,7 @@ jobs:
       fail-fast: false    
       matrix:
         k8s-version: [v1.27.3, v1.26.3]
-        n4k-chart-version: [3.1.18, 3.2.1]
+        n4k-chart-version: [3.1.18, 3.2.2]
 
     steps:
       - name: Checkout
@@ -125,7 +125,7 @@ jobs:
       fail-fast: false    
       matrix:
         k8s-version: [v1.30.0, v1.29.4, v1.28.9]
-        n4k-chart-version: [3.1.18, 3.2.1]
+        n4k-chart-version: [3.1.18, 3.2.2]
 
     steps:
       - name: Checkout

diff --git a/rbac-best-practices-cel/restrict-binding-system-groups/restrict-binding-system-groups.yaml b/rbac-best-practices-cel/restrict-binding-system-groups/restrict-binding-system-groups.yaml
@@ -24,6 +24,9 @@ spec:
             kinds:
               - RoleBinding
               - ClusterRoleBinding
+            operations:
+              - CREATE
+              - UPDATE
       validate:
         cel:
           expressions:

diff --git a/rbac-best-practices-cel/restrict-clusterrole-nodesproxy/restrict-clusterrole-nodesproxy.yaml b/rbac-best-practices-cel/restrict-clusterrole-nodesproxy/restrict-clusterrole-nodesproxy.yaml
@@ -26,6 +26,9 @@ spec:
         - resources:
             kinds:
               - ClusterRole
+            operations:
+              - CREATE
+              - UPDATE
       validate:
         cel:
           expressions:

diff --git a/rbac-best-practices-cel/restrict-escalation-verbs-roles/restrict-escalation-verbs-roles.yaml b/rbac-best-practices-cel/restrict-escalation-verbs-roles/restrict-escalation-verbs-roles.yaml
@@ -24,6 +24,9 @@ spec:
             kinds:
               - Role
               - ClusterRole
+            operations:
+              - CREATE
+              - UPDATE
       validate:
         cel:
           expressions:

diff --git a/rbac-best-practices-cel/restrict-wildcard-resources/restrict-wildcard-resources.yaml b/rbac-best-practices-cel/restrict-wildcard-resources/restrict-wildcard-resources.yaml
@@ -26,6 +26,9 @@ spec:
             kinds:
               - Role
               - ClusterRole
+            operations:
+              - CREATE
+              - UPDATE
       validate:
         cel:
           expressions: