Related issue

Fixes #3114
Maintainers @prateekpandey14 @vyankyGH

Milestone of this PR

What type of PR is this

/kind feature

Proposed Changes

Prior to this PR, only validate and mutate policies were covered by the CLI test command. This PR adds the ability to test generate policies. A complete design proposal can be found here.

Proof Manifests

Consider this generate policy. A sample kyverno-test.yaml file for this policy would look like this -

name: deny-all-traffic
policies:
  - policy.yaml
resources:
  - resource.yaml
results:
  - policy: add-networkpolicy
    rule: default-deny
    resource: hello-world-namespace
    generatedResource: generatedResource.yaml
    kind: Namespace
    result: pass

resource.yaml is the manifest for creating Namespace resource.

apiVersion: v1
kind: Namespace
metadata:
  name: hello-world-namespace

Our test will pass if our generatedResource.yaml looks like this -

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: hello-world-namespace
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.
• This is a feature and I have added CLI tests that are applicable.
• My PR needs to be cherry picked to a specific release branch which is .
• My PR contains new or altered behavior to Kyverno and
  • CLI support should be added and my PR doesn't contain that functionality.
  • I have added or changed the documentation myself in an existing PR and the link is:
  • I have raised an issue in kyverno/website to track the documentation update and the link is:

Further Comments