Test Plan

Kubewarden installation

Test based on the Quick start documentation.

Prerequisites

Kubernetes cluster up and running

Steps

1. Run the commands to install Kubewarden using the Helm charts.

helm repo add kubewarden https://charts.kubewarden.io
helm install --namespace kubewarden --create-namespace kubewarden-controller kubewarden/kubewarden-controller

2. Wait installation to finish
3. Check if the Kubewarden controller pod running

kubectl get pods

4. Check if the ClusterAdmissionPolicy custom resource definition is installed

kubectl get  crds

Expected Results

The Kubewarden stack should be installed and properly configured in the Kubernetes cluster

User should be able to deploy policy

Prerequisites

A Kubernetes cluster with Kubewarden installed.

Steps

1. Define a ClusterAdimissionPolicy

kubectl apply -f - <<EOF
apiVersion: policies.kubewarden.io/v1alpha2
kind: ClusterAdmissionPolicy
metadata:
  name: privileged-pods
spec:
  module: registry://ghcr.io/kubewarden/policies/pod-privileged:v0.1.5
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    operations:
    - CREATE
    - UPDATE
  mutating: false
EOF

2. Check if the policy is listed as a ClusterAdimissionPolicy

kubectl get  clusteradmissionpolicy.policies.kubewarden.io

3. Check if the policy server is up and running

kubectl get pods

Expected results

The policy should be installed in the cluster and active

Trying to create a pod violating a policy should fail

Prerequisites

A Kubernetes cluster with Kubewarden installed.

Steps

1. Define a ClusterAdmissionPolicy

kubectl apply -f - <<EOF
apiVersion: policies.kubewarden.io/v1alpha2
kind: ClusterAdmissionPolicy
metadata:
  name: privileged-pods
spec:
  module: registry://ghcr.io/kubewarden/policies/pod-privileged:v0.1.5
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    operations:
    - CREATE
    - UPDATE
  mutating: false
EOF

2. Wait policy to be active
3. Try to deploy a pod which violates the policy previously defined. It should fail.

kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: privileged-pod
spec:
  containers:
    - name: nginx
      image: nginx:latest
      securityContext:
          privileged: true
EOF

Expected Results

The kubectl command used to create the pod should fail.

Trying to create a pod not violating a policy should succeed.

Prerequisites

A Kubernetes cluster with Kubewarden installed.

Steps

1. Define a ClusterAdmissionPolicy

kubectl apply -f - <<EOF
apiVersion: policies.kubewarden.io/v1alpha2
kind: ClusterAdmissionPolicy
metadata:
  name: privileged-pods
spec:
  module: registry://ghcr.io/kubewarden/policies/pod-privileged:v0.1.5
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    operations:
    - CREATE
    - UPDATE
  mutating: false
EOF

2. Wait policy to be active
3. Try to deploy a pod which violates the policy previously defined. It should not fail.

kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: unprivileged-pod
spec:
  containers:
    - name: nginx
      image: nginx:latest
EOF

Expected Results

The kubectl command used to create the pod should not fail and the pod should be created.

User should be able to delete policy

Prerequisites

A Kubernetes cluster with Kubewarden installed and a policy defined.

Steps

1. Delete the policy defined in the cluster

kubectl  delete -f "privileged-policy.yaml" 

2. Check if the policy is not listed as a ClusterAdimissionPolicy

kubectl get  clusteradmissionpolicy.policies.kubewarden.io

3. Check if the policy server is up and running

kubectl get pods

Expected results

The policy should be removed from the cluster

Uninstall Kubewarden

Test based on the Quick start documentation.

Prerequisites

A Kubernetes cluster with Kubewarden installed.

Steps

1. Delete all ClusterAdimissionPolicy resources
2. Wait for the for the kubewarden-controller to remove all the Kubernetes ValidatingWebhookConfiguration and the MutatingWebhookConfiguration resources it created.
3. Uninstall the Helm chart

Expected Results

After the deinstallation process all the Kubewarden stack should be removed.