feat: add other policies in CEL expressions - Part 3

.github/workflows/test.yml

@@ -53,6 +53,7 @@ jobs:
           - ^other$/^re[c-q]
           - ^other$/^res
           - ^other$/^[s-z]
+          - ^other-cel$/^[m-q]
           - ^pod-security$
           - ^pod-security-cel$
           - ^psa$

other-cel/memory-requests-equal-limits/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,39 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: memory-requests-equal-limits
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: ../memory-requests-equal-limits.yaml
+    - patch:
+        resource:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          metadata:
+            name: memory-requests-equal-limits
+          spec:
+            validationFailureAction: Enforce
+    - assert:
+        file: policy-ready.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: pod-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-bad.yaml
+    - apply:
+        file: podcontroller-good.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: podcontroller-bad.yaml
+

other-cel/memory-requests-equal-limits/.chainsaw-test/pod-bad.yaml

@@ -0,0 +1,77 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: badpod01
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "200Mi"
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: badpod02
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "10Mi"
+      limits:
+        memory: "140Mi"
+  - name: busybox02
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "150Mi"
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: badpod03
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "120Mi"
+      limits:
+        memory: "120Mi"
+  - name: busybox02
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "150Mi"
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: badpod04
+spec:
+  containers:
+  - name: busybox02
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "200Mi"
+  - name: busybox
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "100Mi"
+

other-cel/memory-requests-equal-limits/.chainsaw-test/pod-good.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: goodpod00
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: goodpod01
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "100Mi"
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: goodpod02
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "100Mi"
+      limits:
+        memory: "100Mi"
+  - name: busybox02
+    image: busybox:1.35
+  - name: busybox03
+    image: busybox:1.35
+    resources:
+      requests:
+        memory: "50Mi"
+      limits:
+        memory: "50Mi"
+

other-cel/memory-requests-equal-limits/.chainsaw-test/podcontroller-bad.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: baddeployment01
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+        resources:
+          requests:
+            memory: "10Mi"
+          limits:
+            memory: "140Mi"
+      - name: busybox02
+        image: busybox:1.35
+        resources:
+          requests:
+            memory: "100Mi"
+          limits:
+            memory: "150Mi"
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: badcronjob01
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: busybox
+            image: busybox:1.35
+            resources:
+              requests:
+                memory: "10Mi"
+              limits:
+                memory: "140Mi"
+          - name: busybox02
+            image: busybox:1.35
+            resources:
+              requests:
+                memory: "100Mi"
+              limits:
+                memory: "150Mi"
+          restartPolicy: OnFailure
+

other-cel/memory-requests-equal-limits/.chainsaw-test/podcontroller-good.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: busybox
+  name: gooddeployment01
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: busybox
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: busybox
+    spec:
+      containers:
+      - name: busybox
+        image: busybox:1.35
+        resources:
+          requests:
+            memory: "100Mi"
+          limits:
+            memory: "100Mi"
+      - name: busybox02
+        image: busybox:1.35
+      - name: busybox03
+        image: busybox:1.35
+        resources:
+          requests:
+            memory: "50Mi"
+          limits:
+            memory: "50Mi"
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: goodcronjob01
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: busybox
+            image: busybox:1.35
+            resources:
+              requests:
+                memory: "100Mi"
+              limits:
+                memory: "100Mi"
+          - name: busybox02
+            image: busybox:1.35
+          - name: busybox03
+            image: busybox:1.35
+            resources:
+              requests:
+                memory: "50Mi"
+              limits:
+                memory: "50Mi"
+          restartPolicy: OnFailure
+

other-cel/memory-requests-equal-limits/.chainsaw-test/policy-ready.yaml

@@ -0,0 +1,7 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: memory-requests-equal-limits
+status:
+  ready: true
+

other-cel/memory-requests-equal-limits/.kyverno-test/kyverno-test.yaml

@@ -0,0 +1,28 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: memory-requests-equal-limits
+policies:
+- ../memory-requests-equal-limits.yaml
+resources:
+- resource.yaml
+results:
+- kind: CronJob
+  policy: memory-requests-equal-limits
+  resources:
+  - hello
+  result: pass
+  rule: autogen-cronjob-memory-requests-equal-limits
+- kind: DaemonSet
+  policy: memory-requests-equal-limits
+  resources:
+  - fluentd-elasticsearch
+  result: pass
+  rule: autogen-memory-requests-equal-limits
+- kind: Pod
+  policy: memory-requests-equal-limits
+  resources:
+  - myapp-pod
+  result: fail
+  rule: memory-requests-equal-limits
+