Skip to content

Latest commit

 

History

History
50 lines (40 loc) · 2.14 KB

TESTING.md

File metadata and controls

50 lines (40 loc) · 2.14 KB
Raw

Testing

This repo uses as a combination of bats, conftest and gatekeeper to validate the rego policies.

How do I write a policy?

Each policy lives under its own directory, i.e.: policy/ocp/bestpractices/common-k8s-labels-notset. Every policy must have a test_data directory; within that directory, there should be:

  • unit: should contain only the YAML needed to execute the policy, i.e.: a cut down version
  • integration: should contain valid YAML which can be deployed to a cluster which only triggers the policy under-test

Each policy must have a BATS test executed by its usecase:

Each policy, if applicable, must have an opa eval --profile test executed by _test/opa-profile.sh.

Execute unit tests

bats _test/conftest-unittests.sh

Execute profile tests

bats _test/opa-profile.sh

Execute integration units

_test/deploy-gatekeeper.sh deploy_gatekeeper
_test/deploy-gatekeeper.sh deploy_constraints
bats _test/gatekeeper-integrationtests.sh

Limit Gatekeeper to integration test project only

By default, Gatekeeper watches all projects, unless they are labeled control-plane or admission.gatekeeper.sh/ignore. If you only want Gatekeeper to watch the project created by _test/gatekeeper-integrationtests.sh, run the below before deploy_constraints:

_test/deploy-gatekeeper.sh patch_namespaceselector

Tools used for testing

The following tools must be installed locally: