jpreese

//go:embed build/output/*
var staticFiles embed.FS

func main() {
	fileSystem := fs.FS(staticFiles)
	assets, err := fs.Sub(fileSystem, "build/output")
	if err != nil {
		log.Fatal("load assets:", err)
	}

jpreese

moo

lol i'm a cow

jpreese

Create the following Dockerfile:
---
FROM ubuntu

RUN apt-get update
RUN apt-get install curl sudo docker.io -y

RUN curl -LO https://storage.googleapis.com/container-structure-test/latest/container-structure-test-linux-amd64 && chmod +x container-structure-test-linux-amd64 && sudo mv container-structure-test-linux-amd64 /usr/local/bin/container-structure-test
---

jpreese

package main

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/go-multierror"
)

jpreese

package lib.combine

default is_multidocument = false

is_multidocument {
    input[_][_].kind
}

resources[resource] {
    is_multidocument

jpreese

output := viper.GetString("out")
if filepath.Ext(output) == "" {
  output = filepath.Join(output, "alerts.md")
}

..
rendering.Render(workingDir, filepath.Ext(output))
..

if err := ioutil.WriteFile(output, .., ..); err != nil {

jpreese

package policy

import data.lib.core
import data.lib.workloads

# @title Containers must specify resource constraints
#
# All containers must specify resource constraints, this includes:
# - requests.cpu
# - requests.memory

jpreese

# @title Pods must not have access to the host aliases
#
# Pods that can change aliases in the host's /etc/hosts file can
# redirect traffic to malicious servers.
#
# @kinds apps/DaemonSet apps/Deployment apps/StatefulSet core/Pod

package policy

import data.lib.core

jpreese

# @title PrometheusRules must specify a prometheus label
#
# All PrometheusRules created on the cluster must contain a `prometheus` label
# with a value of `prometheus`. This ensures that the rule is found by the prometheus operator.
#
# @kinds monitoring.coreos.com/PrometheusRule

package policy

import data.lib.core

jpreese

#!/bin/bash

echo ""
echo "RUNNING POLICY TESTS ( •_•)>⌐■-■ "
echo ""

FAIL=0

# Verify that the test resources are NOT applied to the default namespace.
# If any of the test resources are successfully applied, the test fails.