adding a new policy that allows scratch and root policy exceptions #1184
+84
−19
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
Some partners need to run containers as both root and scratch for some of their product(s). Currently, we only allow for one of these exceptions at a time.
Explanation
This PR creates a net new
Policy
that runs a subset of checks, excluding any checks that do not appear in the current root and current scratch policy. Some existing policy names/variables were also refactored to provide better clarity.Testing
Aside from the unit test updates, this was tested in
stage
with project668ed5d57f921e72f6431c4c
and below are the results.Additional Info
More info and business approval for a new policy can be found in