WIP: Psp rules support

What type of PR is this?

Uncomment only one  /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flaky-test

If contributing rules or changes to rules, please make sure to uncomment the appropriate kind

/kind rule/update
/kind rule/create

Any specific area of the project related to this PR?
/area engine
/area rules

/area deployment
/area integrations
/area examples

What this PR does / why we need it:
We've heard from some users that it would be desirable to have a way to "test" a K8s Pod Security Policy (PSP) to see if it has good coverage, before actually enabling the PSP.  Once a PSP is in place, it can prevent pods from running, which can be disruptive.
This adds support for reading a K8s Pod Security Policy (PSP) and converting it to a set of falco rules. These rules can check the conditions specified in the PSP without actually preventing pods from running. This could be a valuable step in development of PSPs.
This adds new command line options --psp <path> and --psp_save [<path>]. When a psp is provided using --psp, it will be internally converted to a set of falco rules that check the conditions of the PSP and loaded into the falco engine. If you wish to save the set of converted falco rules, you can save them using --psp_save.
Many of these rules depend on K8s Audit support, so you'll need to enable and configure K8s Audit in your cluster to fully test a PSP.
Which issue(s) this PR fixes:

Special notes for your reviewer:
Does this PR introduce a user-facing change?:

Add support for reading K8s Pod Security Policies (PSPs) and converting them to a set of falco rules. This can be used to test PSPs without the risk of blocking pod deployments.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: mstemm
If they are not already assigned, you can assign the PR to them by writing /assign @mstemm in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/kind rule-create

@mstemm thanks!
It needs a rebase on top of the master to catch the falco fields checksum, but I'm sure you already know this 😄

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs
e6defc8 Rule name tweaking.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs
e6defc8 Rule name tweaking.
8f881a7 Tests PSP supplementalGroups + MustRunAs
8436036 Fixes for supplementalGroups + MustRunAs

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs
e6defc8 Rule name tweaking.
8f881a7 Tests PSP supplementalGroups + MustRunAs
8436036 Fixes for supplementalGroups + MustRunAs
1c4a74f PSP test supplemental + MayRunAs

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs
e6defc8 Rule name tweaking.
8f881a7 Tests PSP supplementalGroups + MustRunAs
8436036 Fixes for supplementalGroups + MustRunAs
1c4a74f PSP test supplemental + MayRunAs
9f6bb9e Tests for PSP + allowPrivilegeEscalation
315c4b7 Fix tests for PSP allowPrivilegeEscalation

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs
e6defc8 Rule name tweaking.
8f881a7 Tests PSP supplementalGroups + MustRunAs
8436036 Fixes for supplementalGroups + MustRunAs
1c4a74f PSP test supplemental + MayRunAs
9f6bb9e Tests for PSP + allowPrivilegeEscalation
315c4b7 Fix tests for PSP allowPrivilegeEscalation
23e9535 Add tests for allowedCapabilities
9858922 Fix tests for PSP allowedCapabilities

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

6bdc77e WIP on yaml rules templating
2d46a3b More WIP on rule templating
5190cef Add a new index for port ranges
7d41147 Add new k8s audit fields for psp policies
68ecea4 Update for new fields.
dcada2a Fill in sample values for psp policy knobs
f72924f Functional template for some fields
04b8e90 New field ka.req.volume_types.within for PSPs
27b1399 Add support for volume types
d4c49c4 Allow commas in path spec
2b62dbd Make allowed volume types a real list
cdab0d3 Add addl ways to match host paths
960798f Template for allowed host paths
ef51a43 WIP on PSP (flexvolume drivers)
f1883fa WIP PSP (fsGroup)
3756b7b PSP WIP (readOnlyRootFilesystem)
51470db WIP PSP readOnlyRootFilesystem
8bc8b82 Remove debug prints
44a69da PSP WIP runAsUser/runAsNonRoot
dafd1dd WIP PSP runAsGroup
bb5639d Add missing defn.
fc41d0c PSP WIP supplementalGroups
e856c53 WIP PSP allowPrivilegeEscalation
bf3b21d WIP PSP (allowed capabilities)
20693a6 WIP PSP allowedProcMountTypes
cfd927f Be consistent about camelCase (e.g. don't use it)
103c624 WIP PSP get yaml parsing of psp working
432a026 WIP PSP add inja to build
f6bc402 Update engine version checksum
e59240c First version working w/ inja templates
de16fb8 Store params as json object directly
124088b Add context to yaml parse errors
5cb0205 Optionally save psp generated rules
d2f7dc9 Cleaning up template handling
f3db1cd More template cleanups
227b91f Finish template formatting changes.
5f46687 Fix falco compilation problems w/ generated rules
f5b1af3 Fix remaining logical errors w/ templates
3859e9d Update fields checksum
9c831ce Initial skeleton for PSP tests
a62e10d Add test case for hostPID
4e79f47 Don't save psp rules by default.
e858598 Add test for PSP hostIPC
6124417 Update name for test host pid psp
0d265e7 Tests for PSP HostNetwork
2318787 Small wording change in template
afca814 Test for PSP HostPorts
2fe3515 Fix logic for ranges
e509b34 Test for PSP Volumes
ad22bc4 Test PSP Allowed Host Paths
a35212e Small template formatting change
bc434ca Tests PSP FlexVolume drivers
448981b Test PSP fs group + MustRunAs
87eab87 Add support for >,>=,<,<= operators
9212e79 PSP Test MayRunAs
a55b9a1 Test PSP fsGroup + RunAsAny
6492c75 Use right value for "not exists"
1d70832 Properly parse RunAsAny for some psp params
960c8ce Test PSP readOnlyRootFilesystem + neg cases
e639619 Allow no ports/volumes for port/volume checks
e33ee03 WIP on tests for runasuser
57225ff Add new fields for matching items against any vals
35b69e9 Add note to self for more testing.
8875fa2 Refactoring/simplifying runAsUser/runAsGroup chks
21dcd93 Get current runAsUser tests passing
0b7861d Use right rule for runAsRoot test
0d97cc5 Complete runAsUser tests
47834d5 Tests for PSP runAsGroup
5f79455 Fill in must_run_as group indexing methods
abd21a3 Tests for PSP group mayRunAs
e6defc8 Rule name tweaking.
8f881a7 Tests PSP supplementalGroups + MustRunAs
8436036 Fixes for supplementalGroups + MustRunAs
1c4a74f PSP test supplemental + MayRunAs
9f6bb9e Tests for PSP + allowPrivilegeEscalation
315c4b7 Fix tests for PSP allowPrivilegeEscalation
23e9535 Add tests for allowedCapabilities
9858922 Fix tests for PSP allowedCapabilities
d30bf57 Add PSP Tests for allowedProcMount types
837fdc9 Fix PSP tests for allowedProcMount types

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

76378d7 WIP on yaml rules templating
f7d159d More WIP on rule templating
1c4b450 Add a new index for port ranges
493ff98 Add new k8s audit fields for psp policies
b68c607 Update for new fields.
45aa42c Fill in sample values for psp policy knobs
9db7244 Functional template for some fields
21c1396 New field ka.req.volume_types.within for PSPs
fb168fa Add support for volume types
f171b4c Allow commas in path spec
677cc48 Make allowed volume types a real list
8bf52b0 Add addl ways to match host paths
989b258 Template for allowed host paths
3ca4a82 WIP on PSP (flexvolume drivers)
72d5f72 WIP PSP (fsGroup)
b62fc94 PSP WIP (readOnlyRootFilesystem)
821ccbe WIP PSP readOnlyRootFilesystem
653bcaf Remove debug prints
fc65c8e PSP WIP runAsUser/runAsNonRoot
669fada WIP PSP runAsGroup
d162259 Add missing defn.
fff41c3 PSP WIP supplementalGroups
331e50c WIP PSP allowPrivilegeEscalation
43d8d31 WIP PSP (allowed capabilities)
a5c841a WIP PSP allowedProcMountTypes
5088fc4 Be consistent about camelCase (e.g. don't use it)
79ecef6 WIP PSP get yaml parsing of psp working
7950575 WIP PSP add inja to build
8061945 Update engine version checksum
69e7caf First version working w/ inja templates
f37dc33 Store params as json object directly
1bb4ba7 Add context to yaml parse errors
ea43588 Optionally save psp generated rules
f0289f5 Cleaning up template handling
2bf9e93 More template cleanups
e063058 Finish template formatting changes.
29b080c Fix falco compilation problems w/ generated rules
b1ce40f Fix remaining logical errors w/ templates
79e0b09 Update fields checksum
ffab29c Initial skeleton for PSP tests
012d8bd Add test case for hostPID
7a7c520 Don't save psp rules by default.
22b59a5 Add test for PSP hostIPC
e79047c Update name for test host pid psp
c5f8a26 Tests for PSP HostNetwork
83a4be6 Small wording change in template
25f8625 Test for PSP HostPorts
792ba7c Fix logic for ranges
fdc4e5b Test for PSP Volumes
94343d3 Test PSP Allowed Host Paths
c9adcba Small template formatting change
639e86f Tests PSP FlexVolume drivers
c4630af Test PSP fs group + MustRunAs
3f1557c Add support for >,>=,<,<= operators
3cfd5bf PSP Test MayRunAs
59c948c Test PSP fsGroup + RunAsAny
bec5f01 Use right value for "not exists"
19a6b4f Properly parse RunAsAny for some psp params
5821201 Test PSP readOnlyRootFilesystem + neg cases
d426b74 Allow no ports/volumes for port/volume checks
46603a0 WIP on tests for runasuser
ad33dc7 Add new fields for matching items against any vals
61d0e60 Add note to self for more testing.
0e8d339 Refactoring/simplifying runAsUser/runAsGroup chks
01fc99d Get current runAsUser tests passing
58c646a Use right rule for runAsRoot test
642ee5a Complete runAsUser tests
80cac26 Tests for PSP runAsGroup
e8f142f Fill in must_run_as group indexing methods
fba5859 Tests for PSP group mayRunAs
6492cb4 Rule name tweaking.
d571c0b Tests PSP supplementalGroups + MustRunAs
78ae12d Fixes for supplementalGroups + MustRunAs
3a7c3d8 PSP test supplemental + MayRunAs
0cf1539 Tests for PSP + allowPrivilegeEscalation
2d73bb4 Fix tests for PSP allowPrivilegeEscalation
cc06780 Add tests for allowedCapabilities
077163c Fix tests for PSP allowedCapabilities
102c182 Add PSP Tests for allowedProcMount types
1056ab4 Fix PSP tests for allowedProcMount types

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types
f78c965 WIP on rule renaming

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types
f78c965 WIP on rule renaming
7286314 Allow --psp with no rules files

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types
f78c965 WIP on rule renaming
7286314 Allow --psp with no rules files

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types
f78c965 WIP on rule renaming
7286314 Allow --psp with no rules files
9abfd49 Fix bugs in rules specs

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types
f78c965 WIP on rule renaming
7286314 Allow --psp with no rules files
9abfd49 Fix bugs in rules specs
90d7a62 Add addl syscall based rules

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

913f5e3 WIP on yaml rules templating
6e916c9 More WIP on rule templating
0bee30f Add a new index for port ranges
a18de9c Add new k8s audit fields for psp policies
fa66be2 Update for new fields.
be3c004 Fill in sample values for psp policy knobs
fb73c19 Functional template for some fields
18242c3 New field ka.req.volume_types.within for PSPs
282abd8 Add support for volume types
cc07a07 Allow commas in path spec
1958a0f Make allowed volume types a real list
cad3afb Add addl ways to match host paths
f388a98 Template for allowed host paths
b408b45 WIP on PSP (flexvolume drivers)
b03f4bf WIP PSP (fsGroup)
d7b9e46 PSP WIP (readOnlyRootFilesystem)
cce055b WIP PSP readOnlyRootFilesystem
0040e3b Remove debug prints
482e65a PSP WIP runAsUser/runAsNonRoot
e9fb4bc WIP PSP runAsGroup
1c14950 Add missing defn.
559305e PSP WIP supplementalGroups
a27a7c8 WIP PSP allowPrivilegeEscalation
fc3c84f WIP PSP (allowed capabilities)
ac5ae34 WIP PSP allowedProcMountTypes
1707457 Be consistent about camelCase (e.g. don't use it)
5142d46 WIP PSP get yaml parsing of psp working
896efb0 WIP PSP add inja to build
ce3e356 Update engine version checksum
851a1af First version working w/ inja templates
66de323 Store params as json object directly
cfb8023 Optionally save psp generated rules
87d0fce Cleaning up template handling
531d777 More template cleanups
b50235a Finish template formatting changes.
3ea6d10 Fix falco compilation problems w/ generated rules
aa37d54 Fix remaining logical errors w/ templates
f19d4af Update fields checksum
97e45c8 Initial skeleton for PSP tests
ad8f7af Add test case for hostPID
6f8a9f6 Don't save psp rules by default.
93bd0ea Add test for PSP hostIPC
88aa41f Update name for test host pid psp
f7f6f2b Tests for PSP HostNetwork
cf186a3 Small wording change in template
010e446 Test for PSP HostPorts
6e7b405 Fix logic for ranges
f9b92aa Test for PSP Volumes
01a6fc1 Test PSP Allowed Host Paths
ea19a48 Small template formatting change
3ef5350 Tests PSP FlexVolume drivers
b3a04ef Test PSP fs group + MustRunAs
673fc9a Add support for >,>=,<,<= operators
4cf4f58 PSP Test MayRunAs
a4857cf Test PSP fsGroup + RunAsAny
bd22294 Use right value for "not exists"
e666125 Properly parse RunAsAny for some psp params
8779b9a Test PSP readOnlyRootFilesystem + neg cases
e50ef21 Allow no ports/volumes for port/volume checks
37573a9 WIP on tests for runasuser
6141cde Add new fields for matching items against any vals
69bfe67 Add note to self for more testing.
6d02af3 Refactoring/simplifying runAsUser/runAsGroup chks
1e193b7 Get current runAsUser tests passing
e81c986 Use right rule for runAsRoot test
1751e30 Complete runAsUser tests
bf4e09a Tests for PSP runAsGroup
428031e Fill in must_run_as group indexing methods
3a3edf6 Tests for PSP group mayRunAs
fe5efa1 Rule name tweaking.
051e66f Tests PSP supplementalGroups + MustRunAs
058bb2f Fixes for supplementalGroups + MustRunAs
39f1455 PSP test supplemental + MayRunAs
d475625 Tests for PSP + allowPrivilegeEscalation
fe10647 Fix tests for PSP allowPrivilegeEscalation
1e52081 Add tests for allowedCapabilities
61242c7 Fix tests for PSP allowedCapabilities
ce05cf2 Add PSP Tests for allowedProcMount types
07f6f81 Fix PSP tests for allowedProcMount types
f78c965 WIP on rule renaming
7286314 Allow --psp with no rules files
9abfd49 Fix bugs in rules specs
90d7a62 Add addl syscall based rules
3a768d5 Add tests for new syscall based PSP rules

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

59aa25d WIP on yaml rules templating
20037fc More WIP on rule templating
0223810 Add a new index for port ranges
2df9c0d Add new k8s audit fields for psp policies
118b26f Fill in sample values for psp policy knobs
8b6c7f7 Functional template for some fields
458cb80 New field ka.req.volume_types.within for PSPs
dde3523 Add support for volume types
ec546ef Allow commas in path spec
9bd8bcf Make allowed volume types a real list
1fe055e Add addl ways to match host paths
8d7c9c4 Template for allowed host paths
509d21e WIP on PSP (flexvolume drivers)
c8b3a44 WIP PSP (fsGroup)
aa0cfc9 PSP WIP (readOnlyRootFilesystem)
7d3f890 WIP PSP readOnlyRootFilesystem
ebe5ddf Remove debug prints
19000da PSP WIP runAsUser/runAsNonRoot
5db5bc7 WIP PSP runAsGroup
988f1b2 Add missing defn.
c5dddf3 PSP WIP supplementalGroups
ee9e582 WIP PSP allowPrivilegeEscalation
8044554 WIP PSP (allowed capabilities)
07b9c8a WIP PSP allowedProcMountTypes
dc05d68 Be consistent about camelCase (e.g. don't use it)
b5ab471 WIP PSP get yaml parsing of psp working
e094965 WIP PSP add inja to build
15cb736 Update engine version checksum
079ce7c First version working w/ inja templates
07e5fe4 Store params as json object directly
c9877e8 Optionally save psp generated rules
5fb184f Cleaning up template handling
fe085bd More template cleanups
79a098c Finish template formatting changes.
26abaea Fix falco compilation problems w/ generated rules
2aedfe0 Fix remaining logical errors w/ templates
31e67a3 Update fields checksum
7315e5d Initial skeleton for PSP tests
77a90ea Add test case for hostPID
9294baa Don't save psp rules by default.
bb6c62c Add test for PSP hostIPC
9c1b182 Update name for test host pid psp
7b49c1c Tests for PSP HostNetwork
b2042b2 Small wording change in template
7ed3cac Test for PSP HostPorts
c46e1fb Fix logic for ranges
73ad009 Test for PSP Volumes
54cfc33 Test PSP Allowed Host Paths
44715ab Small template formatting change
ef4b80a Tests PSP FlexVolume drivers
1e0ffcd Test PSP fs group + MustRunAs
31c96b7 Add support for >,>=,<,<= operators
0ea6444 PSP Test MayRunAs
a9d8842 Test PSP fsGroup + RunAsAny
1fe2291 Use right value for "not exists"
609e7a8 Properly parse RunAsAny for some psp params
7927838 Test PSP readOnlyRootFilesystem + neg cases
2a562e0 Allow no ports/volumes for port/volume checks
91b155f WIP on tests for runasuser
4e1480c Add new fields for matching items against any vals
52c67de Add note to self for more testing.
421637f Refactoring/simplifying runAsUser/runAsGroup chks
f21b6a4 Get current runAsUser tests passing
d3f3b63 Use right rule for runAsRoot test
1cd5053 Complete runAsUser tests
d2a51d1 Tests for PSP runAsGroup
69cf340 Fill in must_run_as group indexing methods
41cd5dd Tests for PSP group mayRunAs
7e6ca71 Rule name tweaking.
ff4684e Tests PSP supplementalGroups + MustRunAs
db38ffd Fixes for supplementalGroups + MustRunAs
8465acc PSP test supplemental + MayRunAs
d0f8b78 Tests for PSP + allowPrivilegeEscalation
ef6d9c6 Fix tests for PSP allowPrivilegeEscalation
5fa7431 Add tests for allowedCapabilities
3a45849 Fix tests for PSP allowedCapabilities
58030ef Add PSP Tests for allowedProcMount types
25af122 Fix PSP tests for allowedProcMount types
960cdec WIP on rule renaming
bdd626a Allow --psp with no rules files
3863907 Fix bugs in rules specs
495ed97 Add addl syscall based rules
180e4cb Add tests for new syscall based PSP rules

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.
:memo: Please follow instructions in the contributing guide to update your commits with the DCO
Full details of the Developer Certificate of Origin can be found at developercertificate.org.
The list of commits missing DCO signoff:

59aa25d WIP on yaml rules templating
20037fc More WIP on rule templating
0223810 Add a new index for port ranges
2df9c0d Add new k8s audit fields for psp policies
118b26f Fill in sample values for psp policy knobs
8b6c7f7 Functional template for some fields
458cb80 New field ka.req.volume_types.within for PSPs
dde3523 Add support for volume types
ec546ef Allow commas in path spec
9bd8bcf Make allowed volume types a real list
1fe055e Add addl ways to match host paths
8d7c9c4 Template for allowed host paths
509d21e WIP on PSP (flexvolume drivers)
c8b3a44 WIP PSP (fsGroup)
aa0cfc9 PSP WIP (readOnlyRootFilesystem)
7d3f890 WIP PSP readOnlyRootFilesystem
ebe5ddf Remove debug prints
19000da PSP WIP runAsUser/runAsNonRoot
5db5bc7 WIP PSP runAsGroup
988f1b2 Add missing defn.
c5dddf3 PSP WIP supplementalGroups
ee9e582 WIP PSP allowPrivilegeEscalation
8044554 WIP PSP (allowed capabilities)
07b9c8a WIP PSP allowedProcMountTypes
dc05d68 Be consistent about camelCase (e.g. don't use it)
b5ab471 WIP PSP get yaml parsing of psp working
e094965 WIP PSP add inja to build
15cb736 Update engine version checksum
079ce7c First version working w/ inja templates
07e5fe4 Store params as json object directly
c9877e8 Optionally save psp generated rules
5fb184f Cleaning up template handling
fe085bd More template cleanups
79a098c Finish template formatting changes.
26abaea Fix falco compilation problems w/ generated rules
2aedfe0 Fix remaining logical errors w/ templates
31e67a3 Update fields checksum
7315e5d Initial skeleton for PSP tests
77a90ea Add test case for hostPID
9294baa Don't save psp rules by default.
bb6c62c Add test for PSP hostIPC
9c1b182 Update name for test host pid psp
7b49c1c Tests for PSP HostNetwork
b2042b2 Small wording change in template