add sales department as available option of departments (#7)

* add sales department as available option of departments

* bump version to 2.1.1

Author: chrisns

infra/checkov/require-known-department-label/pass3.tf

@@ -0,0 +1,20 @@
+resource "aws_s3_bucket" "b" {
+  bucket = "my-tf-test-bucket"
+  tags = {
+    mycompany.com.department = "sales"
+  }
+}
+
+resource "aws_ami" "example" {
+  name                = "terraform-example"
+  virtualization_type = "hvm"
+  root_device_name    = "/dev/xvda"
+  tags = {
+    mycompany.com.department = "sales"
+  }
+  ebs_block_device {
+    device_name = "/dev/xvda"
+    snapshot_id = "snap-xxxxxxxx"
+    volume_size = 8
+  }
+}

infra/checkov/require-known-department-label/policy.yaml

@@ -25,4 +25,9 @@ definition:
       resource_types: "all"
       attribute: 'tags.mycompany.com.department'
       operator: "equals"
-      value: servicedesk
+      value: servicedesk
+    - cond_type: "attribute"
+      resource_types: "all"
+      attribute: 'tags.mycompany.com.department'
+      operator: "equals"
+      value: sales

kubernetes/kyverno/kustomization.yaml

@@ -1,10 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-nameSuffix: "-2.1.0"
+nameSuffix: "-2.1.1"
 
 commonLabels:
-  mycompany.com/policy-version: "2.1.0"
+  mycompany.com/policy-version: "2.1.1"
 
 resources:
   - require-department-label/policy.yaml

kubernetes/kyverno/require-department-label/fail0.yaml

@@ -3,7 +3,7 @@ kind: Pod
 metadata:
   name: require-department-label-fail0
   labels:
-    mycompany.com/policy-version: "2.1.0"
+    mycompany.com/policy-version: "2.1.1"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-department-label/pass0.yaml

@@ -4,7 +4,7 @@ metadata:
   name: require-department-label-pass0
   labels:
     mycompany.com/department: finance
-    mycompany.com/policy-version: "2.1.0"
+    mycompany.com/policy-version: "2.1.1"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-department-label/policy.yaml

@@ -39,7 +39,7 @@ spec:
             - "*"
           selector:
             matchLabels:
-              mycompany.com/policy-version: "2.1.0"
+              mycompany.com/policy-version: "2.1.1"
     validate:
       message: "The label `mycompany.com/department` is required."
       pattern:

kubernetes/kyverno/require-department-label/skip0.yaml

@@ -4,7 +4,7 @@ metadata:
   name: require-department-label-skip0
   labels:
     mycompany.com/require-department-label: exempt
-    mycompany.com/policy-version: "2.1.0"
+    mycompany.com/policy-version: "2.1.1"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-department-label/skip1.yaml

@@ -4,7 +4,7 @@ metadata:
   name: require-department-label-skip1
   namespace: kube-system
   labels:
-    mycompany.com/policy-version: "2.1.0"
+    mycompany.com/policy-version: "2.1.1"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-known-department-label/fail0.yaml

@@ -4,7 +4,7 @@ metadata:
   name: require-known-department-label-fail0
   labels:
     mycompany.com/department: nothr
-    mycompany.com/policy-version: "2.1.0"
+    mycompany.com/policy-version: "2.1.1"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-known-department-label/pass0.yaml

@@ -4,7 +4,7 @@ metadata:
   name: require-known-department-label-pass0
   labels:
     mycompany.com/department: hr
-    mycompany.com/policy-version: "2.1.0"
+    mycompany.com/policy-version: "2.1.1"
 spec:
   containers:
   - name: nginx