[ [], [], [], [ "tests/kata/data/k8s-policy-pod/policy.rego:1046: CreateSandboxRequest: i_pidns = false" ], [], [ "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = true", "tests/kata/data/k8s-policy-pod/policy.rego:84: allow_anno 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-log-directory\": \"^/var/log/pods/$(sandbox-namespace)_$(sandbox-name)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"nerdctl/network-namespace\": \"^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"}", "tests/kata/data/k8s-policy-pod/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.katacontainers.pkg.oci.container_type\": \"pod_sandbox\", \"io.kubernetes.cri.container-type\": \"sandbox\", \"io.kubernetes.cri.sandbox-cpu-period\": \"100000\", \"io.kubernetes.cri.sandbox-cpu-quota\": \"0\", \"io.kubernetes.cri.sandbox-cpu-shares\": \"2\", \"io.kubernetes.cri.sandbox-id\": \"e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.kubernetes.cri.sandbox-log-directory\": \"/var/log/pods/kata-containers-k8s-tests_policy-pod_f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\", \"io.kubernetes.cri.sandbox-memory\": \"0\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\", \"nerdctl/network-namespace\": \"/var/run/netns/cni-3e413870-ed7b-d970-7440-cc55c7795613\"}", "tests/kata/data/k8s-policy-pod/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-log-directory\", \"io.kubernetes.cri.sandbox-memory\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\", \"nerdctl/network-namespace\"}", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-period", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-period", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-quota", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-quota", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-cpu-shares", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-cpu-shares", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-log-directory", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-log-directory", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-memory", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-memory", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = nerdctl/network-namespace", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = nerdctl/network-namespace", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:101: allow_anno 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:123: allow_by_anno 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:137: allow_by_anno 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:143: allow_by_anno 2: i_s_name = policy-pod p_s_name = policy-pod", "tests/kata/data/k8s-policy-pod/policy.rego:169: allow_sandbox_name 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:173: allow_sandbox_name 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:176: allow_sandbox_name 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:152: allow_by_sandbox_name: start", "tests/kata/data/k8s-policy-pod/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", "tests/kata/data/k8s-policy-pod/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", "tests/kata/data/k8s-policy-pod/policy.rego:196: allow_by_container_types: p_cri_type = sandbox i_cri_type = sandbox", "tests/kata/data/k8s-policy-pod/policy.rego:205: allow_by_container_type 1: i_cri_type = sandbox", "tests/kata/data/k8s-policy-pod/policy.rego:209: allow_by_container_type 1: i_kata_type = pod_sandbox", "tests/kata/data/k8s-policy-pod/policy.rego:236: allow_sandbox_container_name: start", "tests/kata/data/k8s-policy-pod/policy.rego:252: container_annotation_missing: io.kubernetes.cri.container-name", "tests/kata/data/k8s-policy-pod/policy.rego:257: container_annotation_missing: true", "tests/kata/data/k8s-policy-pod/policy.rego:240: allow_sandbox_container_name: true", "tests/kata/data/k8s-policy-pod/policy.rego:274: allow_sandbox_net_namespace: start", "tests/kata/data/k8s-policy-pod/policy.rego:280: allow_sandbox_net_namespace: p_namespace = ^/var/run/netns/cni-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ i_namespace = /var/run/netns/cni-3e413870-ed7b-d970-7440-cc55c7795613", "tests/kata/data/k8s-policy-pod/policy.rego:284: allow_sandbox_net_namespace: true", "tests/kata/data/k8s-policy-pod/policy.rego:300: allow_sandbox_log_directory: start", "tests/kata/data/k8s-policy-pod/policy.rego:307: allow_sandbox_log_directory: regex2 = ^/var/log/pods/kata-containers-k8s-tests_policy-pod_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", "tests/kata/data/k8s-policy-pod/policy.rego:310: allow_sandbox_log_directory: i_dir = /var/log/pods/kata-containers-k8s-tests_policy-pod_f7641c61-8a63-4bc6-98b9-6a4a5b0d860a", "tests/kata/data/k8s-policy-pod/policy.rego:314: allow_sandbox_log_directory: true", "tests/kata/data/k8s-policy-pod/policy.rego:216: allow_by_container_type 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:220: allow_by_container_type 2: i_cri_type = sandbox", "tests/kata/data/k8s-policy-pod/policy.rego:201: allow_by_container_types: true", "tests/kata/data/k8s-policy-pod/policy.rego:430: allow_by_bundle_or_sandbox_id: start", "tests/kata/data/k8s-policy-pod/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2 regex = ^[a-z0-9]{64}$", "tests/kata/data/k8s-policy-pod/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", "tests/kata/data/k8s-policy-pod/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", "tests/kata/data/k8s-policy-pod/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2/rootfs", "tests/kata/data/k8s-policy-pod/policy.rego:711: allow_root_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = proc", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = proc", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = devpts", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = devpts", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = mqueue", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = mqueue", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = sysfs", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = sysfs", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"/run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2-c9c9b9dc84433468-resolv.conf\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"ro\", \"nosuid\", \"nodev\", \"noexec\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2-[a-z0-9]{16}-resolv.conf$", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:452: allow_by_bundle_or_sandbox_id: true", "tests/kata/data/k8s-policy-pod/policy.rego:459: allow_process: i terminal = false p terminal = false", "tests/kata/data/k8s-policy-pod/policy.rego:462: allow_process: i cwd = / i cwd = /", "tests/kata/data/k8s-policy-pod/policy.rego:465: allow_process: i noNewPrivileges = true p noNewPrivileges = true", "tests/kata/data/k8s-policy-pod/policy.rego:982: allow_caps: policy Ambient = []", "tests/kata/data/k8s-policy-pod/policy.rego:983: allow_caps: input Ambient = []", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", "tests/kata/data/k8s-policy-pod/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", "tests/kata/data/k8s-policy-pod/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:994: allow_caps: policy Inheritable = []", "tests/kata/data/k8s-policy-pod/policy.rego:995: allow_caps: input Inheritable = []", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", "tests/kata/data/k8s-policy-pod/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:497: allow_args 1: no args", "tests/kata/data/k8s-policy-pod/policy.rego:505: allow_args 2: policy args = [\"/pause\"]", "tests/kata/data/k8s-policy-pod/policy.rego:506: allow_args 2: input args = [\"/pause\"]", "tests/kata/data/k8s-policy-pod/policy.rego:518: allow_arg 1: i = 0 i_arg = /pause p_arg = /pause", "tests/kata/data/k8s-policy-pod/policy.rego:523: allow_arg 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:527: allow_arg 2: i = 0 i_arg = /pause p_arg = /pause", "tests/kata/data/k8s-policy-pod/policy.rego:536: allow_arg 3: i = 0 i_arg = /pause p_arg = /pause", "tests/kata/data/k8s-policy-pod/policy.rego:540: allow_arg 3: p_arg3 = /pause", "tests/kata/data/k8s-policy-pod/policy.rego:543: allow_arg 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:514: allow_args 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", "tests/kata/data/k8s-policy-pod/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"]", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:556: allow_env: true", "tests/kata/data/k8s-policy-pod/policy.rego:473: allow_process: true", "tests/kata/data/k8s-policy-pod/policy.rego:165: allow_by_sandbox_name: true", "tests/kata/data/k8s-policy-pod/policy.rego:148: allow_by_anno 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", "tests/kata/data/k8s-policy-pod/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", "tests/kata/data/k8s-policy-pod/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/proc/scsi\"]", "tests/kata/data/k8s-policy-pod/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/acpi\", \"/proc/asound\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/sys/firmware\", \"/sys/devices/virtual/powercap\", \"/proc/scsi\"]", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/asound", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/keys", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:352: allow_masked_paths 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:355: allow_masked_paths 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", "tests/kata/data/k8s-policy-pod/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", "tests/kata/data/k8s-policy-pod/policy.rego:389: allow_readonly_paths 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:392: allow_readonly_paths 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:340: allow_linux: true", "tests/kata/data/k8s-policy-pod/policy.rego:79: CreateContainerRequest: true", "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = true" ], [], [], [], [], [], [ "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = true i Readonly = false", "tests/kata/data/k8s-policy-pod/policy.rego:57: ======== CreateContainerRequest: trying next policy container", "tests/kata/data/k8s-policy-pod/policy.rego:61: CreateContainerRequest: p_pidns = false i_pidns = false", "tests/kata/data/k8s-policy-pod/policy.rego:66: CreateContainerRequest: p Version = 1.1.0 i Version = 1.1.0", "tests/kata/data/k8s-policy-pod/policy.rego:69: CreateContainerRequest: p Readonly = false i Readonly = false", "tests/kata/data/k8s-policy-pod/policy.rego:84: allow_anno 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:91: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\"}", "tests/kata/data/k8s-policy-pod/policy.rego:92: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"quay.io/prometheus/busybox:latest\", \"io.kubernetes.cri.sandbox-id\": \"e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2\", \"io.kubernetes.cri.sandbox-name\": \"policy-pod\", \"io.kubernetes.cri.sandbox-namespace\": \"kata-containers-k8s-tests\", \"io.kubernetes.cri.sandbox-uid\": \"f7641c61-8a63-4bc6-98b9-6a4a5b0d860a\"}", "tests/kata/data/k8s-policy-pod/policy.rego:95: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-name", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-name", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.container-type", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.container-type", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.image-name", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.image-name", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace", "tests/kata/data/k8s-policy-pod/policy.rego:117: allow_anno_key 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:105: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid", "tests/kata/data/k8s-policy-pod/policy.rego:109: allow_anno_key 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:112: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid", "tests/kata/data/k8s-policy-pod/policy.rego:101: allow_anno 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:123: allow_by_anno 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:137: allow_by_anno 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:143: allow_by_anno 2: i_s_name = policy-pod p_s_name = policy-pod", "tests/kata/data/k8s-policy-pod/policy.rego:169: allow_sandbox_name 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:173: allow_sandbox_name 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:176: allow_sandbox_name 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:152: allow_by_sandbox_name: start", "tests/kata/data/k8s-policy-pod/policy.rego:158: allow_by_sandbox_name: p_namespace = kata-containers-k8s-tests i_namespace = kata-containers-k8s-tests", "tests/kata/data/k8s-policy-pod/policy.rego:190: allow_by_container_types: checking io.kubernetes.cri.container-type", "tests/kata/data/k8s-policy-pod/policy.rego:196: allow_by_container_types: p_cri_type = container i_cri_type = container", "tests/kata/data/k8s-policy-pod/policy.rego:205: allow_by_container_type 1: i_cri_type = container", "tests/kata/data/k8s-policy-pod/policy.rego:220: allow_by_container_type 2: i_cri_type = container", "tests/kata/data/k8s-policy-pod/policy.rego:224: allow_by_container_type 2: i_kata_type = pod_container", "tests/kata/data/k8s-policy-pod/policy.rego:244: allow_container_name: start", "tests/kata/data/k8s-policy-pod/policy.rego:261: allow_container_annotation: key = io.kubernetes.cri.container-name", "tests/kata/data/k8s-policy-pod/policy.rego:265: allow_container_annotation: p_value = busybox i_value = busybox", "tests/kata/data/k8s-policy-pod/policy.rego:269: allow_container_annotation: true", "tests/kata/data/k8s-policy-pod/policy.rego:248: allow_container_name: true", "tests/kata/data/k8s-policy-pod/policy.rego:288: allow_net_namespace: start", "tests/kata/data/k8s-policy-pod/policy.rego:295: allow_net_namespace: true", "tests/kata/data/k8s-policy-pod/policy.rego:318: allow_log_directory: start", "tests/kata/data/k8s-policy-pod/policy.rego:325: allow_log_directory: true", "tests/kata/data/k8s-policy-pod/policy.rego:231: allow_by_container_type 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:201: allow_by_container_types: true", "tests/kata/data/k8s-policy-pod/policy.rego:430: allow_by_bundle_or_sandbox_id: start", "tests/kata/data/k8s-policy-pod/policy.rego:440: allow_by_bundle_or_sandbox_id: sandbox_id = e4bd2a97acb81f9ea31d49e21ef2675bcd8bf6883d3cd4273d6d4fb2f6fcbba2 regex = ^[a-z0-9]{64}$", "tests/kata/data/k8s-policy-pod/policy.rego:701: allow_root_path: i_path = /run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9/rootfs p_path1 = $(cpath)/$(bundle-id)/rootfs", "tests/kata/data/k8s-policy-pod/policy.rego:704: allow_root_path: p_path2 = /run/kata-containers/shared/containers/$(bundle-id)/rootfs", "tests/kata/data/k8s-policy-pod/policy.rego:707: allow_root_path: p_path3 = /run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9/rootfs", "tests/kata/data/k8s-policy-pod/policy.rego:711: allow_root_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = proc", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = proc", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = tmpfs", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = tmpfs", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = devpts", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = devpts", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = mqueue", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = mqueue", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = sysfs", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = sysfs", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = cgroup", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = cgroup", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-b0241970194aa0f1-hosts\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-hosts$", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hosts$", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-70afdd32aae261c9-termination-log\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-termination-log$", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-termination-log$", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-cdfc9069abab6aa0-hostname\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-hostname$", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-hostname$", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-a9ad9599a85707b3-resolv.conf\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-resolv.conf$", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-resolv.conf$", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:730: check_mount 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = /run/kata-containers/sandbox/shm", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = /run/kata-containers/sandbox/shm", "tests/kata/data/k8s-policy-pod/policy.rego:762: mount_source_allows 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:716: allow_mount: i_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-5f0e5e3718c35792-serviceaccount\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/proc\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"proc\", \"type_\": \"proc\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev\", \"options\": [\"nosuid\", \"strictatime\", \"mode=755\", \"size=65536k\"], \"source\": \"tmpfs\", \"type_\": \"tmpfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/pts\", \"options\": [\"nosuid\", \"noexec\", \"newinstance\", \"ptmxmode=0666\", \"mode=0620\", \"gid=5\"], \"source\": \"devpts\", \"type_\": \"devpts\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/shm\", \"options\": [\"rbind\"], \"source\": \"/run/kata-containers/sandbox/shm\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/mqueue\", \"options\": [\"nosuid\", \"noexec\", \"nodev\"], \"source\": \"mqueue\", \"type_\": \"mqueue\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"ro\"], \"source\": \"sysfs\", \"type_\": \"sysfs\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/sys/fs/cgroup\", \"options\": [\"nosuid\", \"noexec\", \"nodev\", \"relatime\", \"ro\"], \"source\": \"cgroup\", \"type_\": \"cgroup\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hosts\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hosts$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/dev/termination-log\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)termination-log$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/hostname\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)hostname$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/etc/resolv.conf\", \"options\": [\"rbind\", \"rprivate\", \"rw\"], \"source\": \"$(sfprefix)resolv.conf$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/kubernetes.io/serviceaccount\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)serviceaccount$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:748: mount_source_allows 1: regex4 = ^/run/kata-containers/shared/containers/151c95eb53118154e0574814181406187332a6569c6c82bcf29e3e89392282c9-[a-z0-9]{16}-serviceaccount$", "tests/kata/data/k8s-policy-pod/policy.rego:751: mount_source_allows 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:759: mount_source_allows 2: regex4 = ^/run/kata-containers/shared/containers/$(bundle-id)-[a-z0-9]{16}-serviceaccount$", "tests/kata/data/k8s-policy-pod/policy.rego:739: check_mount 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:725: allow_mount: true", "tests/kata/data/k8s-policy-pod/policy.rego:719: allow_mount: p_mount = {\"destination\": \"/var/run/secrets/azure/tokens\", \"options\": [\"rbind\", \"rprivate\", \"ro\"], \"source\": \"$(sfprefix)tokens$\", \"type_\": \"bind\"}", "tests/kata/data/k8s-policy-pod/policy.rego:452: allow_by_bundle_or_sandbox_id: true", "tests/kata/data/k8s-policy-pod/policy.rego:459: allow_process: i terminal = false p terminal = false", "tests/kata/data/k8s-policy-pod/policy.rego:462: allow_process: i cwd = / i cwd = /", "tests/kata/data/k8s-policy-pod/policy.rego:465: allow_process: i noNewPrivileges = false p noNewPrivileges = false", "tests/kata/data/k8s-policy-pod/policy.rego:982: allow_caps: policy Ambient = []", "tests/kata/data/k8s-policy-pod/policy.rego:983: allow_caps: input Ambient = []", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:986: allow_caps: policy Bounding = [\"$(default_caps)\"]", "tests/kata/data/k8s-policy-pod/policy.rego:987: allow_caps: input Bounding = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:990: allow_caps: policy Effective = [\"$(default_caps)\"]", "tests/kata/data/k8s-policy-pod/policy.rego:991: allow_caps: input Effective = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:994: allow_caps: policy Inheritable = []", "tests/kata/data/k8s-policy-pod/policy.rego:995: allow_caps: input Inheritable = []", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1008: match_caps 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:998: allow_caps: policy Permitted = [\"$(default_caps)\"]", "tests/kata/data/k8s-policy-pod/policy.rego:999: allow_caps: input Permitted = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1004: match_caps 1: start", "tests/kata/data/k8s-policy-pod/policy.rego:1011: match_caps 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:1016: match_caps 2: default_caps = [\"CAP_CHOWN\", \"CAP_DAC_OVERRIDE\", \"CAP_FSETID\", \"CAP_FOWNER\", \"CAP_MKNOD\", \"CAP_NET_RAW\", \"CAP_SETGID\", \"CAP_SETUID\", \"CAP_SETFCAP\", \"CAP_SETPCAP\", \"CAP_NET_BIND_SERVICE\", \"CAP_SYS_CHROOT\", \"CAP_KILL\", \"CAP_AUDIT_WRITE\"]", "tests/kata/data/k8s-policy-pod/policy.rego:1019: match_caps 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:1022: match_caps 3: start", "tests/kata/data/k8s-policy-pod/policy.rego:497: allow_args 1: no args", "tests/kata/data/k8s-policy-pod/policy.rego:505: allow_args 2: policy args = [\"sh\"]", "tests/kata/data/k8s-policy-pod/policy.rego:506: allow_args 2: input args = [\"sh\"]", "tests/kata/data/k8s-policy-pod/policy.rego:518: allow_arg 1: i = 0 i_arg = sh p_arg = sh", "tests/kata/data/k8s-policy-pod/policy.rego:523: allow_arg 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:527: allow_arg 2: i = 0 i_arg = sh p_arg = sh", "tests/kata/data/k8s-policy-pod/policy.rego:536: allow_arg 3: i = 0 i_arg = sh p_arg = sh", "tests/kata/data/k8s-policy-pod/policy.rego:540: allow_arg 3: p_arg3 = sh", "tests/kata/data/k8s-policy-pod/policy.rego:543: allow_arg 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:514: allow_args 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:548: allow_env: p env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=$(host-name)\", \"KUBE_CONFIG_1=value-1\", \"KUBE_CONFIG_2=value-2\"]", "tests/kata/data/k8s-policy-pod/policy.rego:549: allow_env: i env = [\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", \"HOSTNAME=policy-pod\", \"KUBE_CONFIG_1=value-1\", \"KUBE_CONFIG_2=value-2\", \"KUBERNETES_PORT_443_TCP_PROTO=tcp\", \"KUBERNETES_PORT_443_TCP_PORT=443\", \"KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1\", \"KUBERNETES_SERVICE_HOST=10.0.0.1\", \"KUBERNETES_SERVICE_PORT=443\", \"KUBERNETES_SERVICE_PORT_HTTPS=443\", \"KUBERNETES_PORT=tcp://10.0.0.1:443\", \"KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443\"]", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = HOSTNAME=policy-pod", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:619: allow_var 5: true", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:563: allow_var 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:574: allow_var 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PROTO=tcp", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_PORT=443", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP_ADDR=10.0.0.1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_PORT_443_TCP_ADDR p_var = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_HOST=10.0.0.1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:654: allow_pod_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:666: allow_host_ip_var: var_name = KUBERNETES_SERVICE_HOST p_var = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT=443", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_SERVICE_PORT_HTTPS=443", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT=tcp://10.0.0.1:443", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:552: allow_env: i_var = KUBERNETES_PORT_443_TCP=tcp://10.0.0.1:443", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = HOSTNAME=$(host-name)", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_1=value-1", "tests/kata/data/k8s-policy-pod/policy.rego:571: allow_var 2: p_var2 = KUBE_CONFIG_2=value-2", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^HOSTNAME=[a-zA-Z0-9_\\.\\-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:588: allow_var 3: true", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PROTO=tcp$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT_[0-9]{1,5}_TCP_ADDR=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_HOST=(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_SERVICE_PORT_[a-zA-Z0-9_\\.\\-]+=[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^[A-Z_\\.\\-]+_PORT=tcp://(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):[0-9]{1,5}$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_CLIENT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_TENANT_ID=[A-Fa-f0-9-]+$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$", "tests/kata/data/k8s-policy-pod/policy.rego:585: allow_var 3: p_regex5 = ^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$", "tests/kata/data/k8s-policy-pod/policy.rego:556: allow_env: true", "tests/kata/data/k8s-policy-pod/policy.rego:473: allow_process: true", "tests/kata/data/k8s-policy-pod/policy.rego:165: allow_by_sandbox_name: true", "tests/kata/data/k8s-policy-pod/policy.rego:148: allow_by_anno 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:330: allow_linux: p namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", "tests/kata/data/k8s-policy-pod/policy.rego:333: allow_linux: i namespaces = [{\"Path\": \"\", \"Type\": \"ipc\"}, {\"Path\": \"\", \"Type\": \"uts\"}, {\"Path\": \"\", \"Type\": \"mount\"}]", "tests/kata/data/k8s-policy-pod/policy.rego:345: allow_masked_paths 1: p_paths = [\"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", "tests/kata/data/k8s-policy-pod/policy.rego:348: allow_masked_paths 1: i_paths = [\"/proc/asound\", \"/proc/acpi\", \"/proc/kcore\", \"/proc/keys\", \"/proc/latency_stats\", \"/proc/timer_list\", \"/proc/timer_stats\", \"/proc/sched_debug\", \"/proc/scsi\", \"/sys/firmware\"]", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/acpi", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/kcore", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/keys", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/latency_stats", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_list", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/timer_stats", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/sched_debug", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /proc/scsi", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:372: allow_masked_path: p_elem = /sys/firmware", "tests/kata/data/k8s-policy-pod/policy.rego:377: allow_masked_path: true", "tests/kata/data/k8s-policy-pod/policy.rego:352: allow_masked_paths 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:355: allow_masked_paths 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:382: allow_readonly_paths 1: p_paths = [\"/proc/asound\", \"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", "tests/kata/data/k8s-policy-pod/policy.rego:385: allow_readonly_paths 1: i_paths = [\"/proc/bus\", \"/proc/fs\", \"/proc/irq\", \"/proc/sys\", \"/proc/sysrq-trigger\"]", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/asound", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/asound", "tests/kata/data/k8s-policy-pod/policy.rego:424: allow_readonly_path 2: true", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/bus", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/bus", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/fs", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/fs", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/irq", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/irq", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sys", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sys", "tests/kata/data/k8s-policy-pod/policy.rego:411: allow_readonly_path 1: p_elem = /proc/sysrq-trigger", "tests/kata/data/k8s-policy-pod/policy.rego:416: allow_readonly_path 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:419: allow_readonly_path 2: p_elem = /proc/sysrq-trigger", "tests/kata/data/k8s-policy-pod/policy.rego:389: allow_readonly_paths 1: true", "tests/kata/data/k8s-policy-pod/policy.rego:392: allow_readonly_paths 2: start", "tests/kata/data/k8s-policy-pod/policy.rego:340: allow_linux: true", "tests/kata/data/k8s-policy-pod/policy.rego:79: CreateContainerRequest: true" ], [], [], [], [], [] ]