fuzz

var (
	Policies map[int]*BypassChecker

	LatestImageTagPolicy = []byte(`{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "latest-image-tag-policy"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "validate-tag",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "An image tag is required",
					"pattern": {
					   "spec": {
						  "containers": [
							 {
								"image": "*:*"
							 }
						  ]
					   }
					}
				 }
			  },
			  {
				 "name": "validate-latest",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "If the image has 'latest' tag then imagePullPolicy must be 'Always'",
					"pattern": {
					   "spec": {
						  "containers": [
							 {
								"(image)": "*latest",
								"imagePullPolicy": "Always"
							 }
						  ]
					   }
					}
				 }
			  }
		   ]
		}
	 }
	`)

	EqualityHostpathPolicy = []byte(`
	{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "equality-hostpath-policy"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "validate-host-path",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "Host path '/var/lib/' is not allowed",
					"pattern": {
					   "spec": {
						  "volumes": [
							 {
								"=(hostPath)": {
								   "path": "!/var/lib"
								}
							 }
						  ]
					   }
					}
				 }
			  }
		   ]
		}
	 }
	 `)
	SecurityContextPolicy = []byte(`{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "security-context-policy"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "pod rule 2",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "pod: validate run as non root user",
					"pattern": {
					   "spec": {
						  "=(securityContext)": {
							 "runAsNonRoot": true
						  }
					   }
					}
				 }
			  }
		   ]
		}
	 }`)

	ContainerNamePolicy = []byte(`
	{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		  "name": "container-name-policy"
		},
		"spec": {
		  "rules": [
			{
			  "name": "pod image rule",
			  "match": {
				"resources": {
				  "kinds": [
					"Pod"
				  ]
				}
			  },
			  "validate": {
				"pattern": {
				  "spec": {
					"=(containers)": [
					  {
						"name": "nginx"
					  }
					]
				  }
				}
			  }
			}
		  ]
		}
	  }`)

	PodExistencePolicy = []byte(`
	{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		  "name": "pod-existence-policy"
		},
		"spec": {
		  "rules": [
			{
			  "name": "pod image rule",
			  "match": {
				"resources": {
				  "kinds": [
					"Pod"
				  ]
				}
			  },
			  "validate": {
				"pattern": {
				  "spec": {
					"^(containers)": [
					  {
						"name": "nginx"
					  }
					]
				  }
				}
			  }
			}
		  ]
		}
	  }
		 `)

	HostPathCannotExistPolicy = []byte(`
	{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		  "name": "host-path-cannot-exist-policy"
		},
		"spec": {
		  "rules": [
			{
			  "name": "validate-host-path",
			  "match": {
				"resources": {
				  "kinds": [
					"Pod"
				  ]
				}
			  },
			  "validate": {
				"message": "Host path is not allowed",
				"pattern": {
				  "spec": {
					"volumes": [
					  {
						"name": "*",
						"X(hostPath)": null
					  }
					]
				  }
				}
			  }
			}
		  ]
		}
	  }
	 `)
	NamespaceCannotBeEmptyOrDefaultPolicy = []byte(`
	{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "namespace-cannot-be-empty-or-default-policy"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "check-default-namespace",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "A namespace is required",
					"anyPattern": [
					   {
						  "metadata": {
							 "namespace": "?*"
						  }
					   },
					   {
						  "metadata": {
							 "namespace": "!default"
						  }
					   }
					]
				 }
			  }
		   ]
		}
	 }
	`)

	HostnetworkAndPortNotAllowedPolicy = []byte(`
	{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "hostnetwork-and-port-not-allowed-policy"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "validate-host-network-port",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "Host network and port are not allowed",
					"pattern": {
					   "spec": {
						  "hostNetwork": false,
						  "containers": [
							 {
								"name": "*",
								"ports": [
								   {
									  "hostPort": null
								   }
								]
							 }
						  ]
					   }
					}
				 }
			  }
		   ]
		}
	 }
	 `)

	SupplementalGroupsShouldBeHigherThanZeroPolicy = []byte(`{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "supplemental-groups-should-be-higher-than-zero-policy"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "pod rule 2",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "pod: validate run as non root user",
					"pattern": {
					   "spec": {
						  "=(supplementalGroups)": ">0"
					   }
					}
				 }
			  }
		   ]
		}
	 }	 `)

	SupplementalGroupsShouldBeBetween = []byte(`{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "supplemental-groups-should-be-between"
		},
		"spec": {
		   "rules": [
			  {
				 "name": "pod rule 2",
				 "match": {
					"resources": {
					   "kinds": [
						  "Pod"
					   ]
					}
				 },
				 "validate": {
					"message": "pod: validate run as non root user",
					"pattern": {
					   "spec": {
						"=(supplementalGroups)": [
							">0 & <100001"
						  ]
					   }
					}
				 }
			  }
		   ]
		}
	 }	 `)

	ShouldHaveMoreMemoryThanFirstContainer = []byte(`{
		"apiVersion": "kyvernov1.io/v1",
		"kind": "ClusterPolicy",
		"metadata": {
		   "name": "should-have-more-memory-than-first-container"
		},
		"spec": {
		   "rules": [
				{
					"name": "validate-host-network-port",
					"match": {
						"resources": {
					   		"kinds": [
						  		"Pod"
					   		]
						}
				 	},
				 	"validate": {
						"message": "Host network and port are not allowed",
						"pattern": {
					   		"spec":{
								"containers":[
									{
										"name":"*",
										"resources":{
											"requests":{
												"memory":"$(<=/spec/containers/0/resources/limits/memory)"
											},
											"limits":{
												"memory":"2048Mi"
											}
										}
									}
								]
							}
						}
				 	}
			  	}
		   	]
		}
	}	 `)
)