docs:Testing Policies for kubernetes.admission is misleading

[lxlxok]

Doc in this page is misleading, https://www.openpolicyagent.org/docs/latest/kubernetes-primer/

Expected Behavior

Test case should not be affected by other policies in the same package.
Policy should looks like:

deny[msg] {  
image_deny
}

image_deny {
......
}

Test case should looks like:

test_image_safety {
...
   image_deny with input as unsafe_image 
}

Actual Behavior

https://play.openpolicyagent.org/p/Zdg4K921Vt

Since all the policy is logical disjunction. If we check test case throughcount(admission.deny) == 1 with input as unsafe_image we might have some problem, even the test case Pass.
Since the test case might be rejected by other policy in the same package kubernetes.admission

[tsandall]

That's fair, however, I think we want the first example policy on the page to be as simple as possible. Factoring the logic into a helper rule might be a good idea but it also makes the first example more complicated. What we can do here is update the test to check for a specific message in the deny set so that other deny rules don't affect it.

…

On Thu, Sep 26, 2019 at 10:01 PM Xiao Li ***@***.***> wrote: Doc in this page is misleading, https://www.openpolicyagent.org/docs/latest/kubernetes-primer/ Expected Behavior Test case should not be affected by other policies in the same package. Policy should looks like: deny[msg] { image_deny } image_deny { ...... } Test case should looks like: test_image_safety { ... image_deny with input as unsafe_image } Actual Behavior https://play.openpolicyagent.org/p/Zdg4K921Vt Since all the policy is logical disjunction. If we check test case throughcount(admission.deny) == 1 with input as unsafe_image we might have some problem, even the test case Pass. Since the test case might be rejected by other policy in the same package kubernetes.admission — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1794?email_source=notifications&email_token=AAB2KJM57DXXEX7V267NADLQLVSQFA5CNFSM4I3A4BK2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HOBDJAA>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAB2KJMGSP4JVQY7N7CKFELQLVSQFANCNFSM4I3A4BKQ> .

-- -Torin