adds test for postgresql, fixes slsa condition for web

Author: timbastin

templates/kyverno-policy.yaml

@@ -55,9 +55,11 @@ spec:
                     - key: "{{ `{{ predicate.runDetails.builder.id }}` }}"
                       operator: Equals
                       value: "devguard.org"
-                    - key: "{{ `{{ contains(predicate.buildDefinition.externalParameters.remotes, 'https://github.com/l3montree-dev/devguard') }}` }}"
-                      operator: Equals
-                      value: true
+                    - key: "{{ `{{ predicate.buildDefinition.externalParameters.remotes }}` }}"
+                      operator: AnyIn
+                      value:
+                        - "https://github.com/l3montree-dev/devguard"
+                        - "https://github.com/l3montree-dev/devguard-web"
                     # personal email addresses from maintainers - those are
                     # hardcoded because we don't want to allow any other maintainers to sign the images
                     # numeric GitHub user IDs in noreply emails are permanent even if username changes

tests/kyverno/kyverno-test.yaml

@@ -7,6 +7,7 @@ policies:
 resources:
   - resources/pod-devguard.yaml
   - resources/pod-devguard-web.yaml
+  - resources/pod-postgresql.yaml
 results:
   - policy: verify-image-signatures
     rule: verify-devguard-images
@@ -20,3 +21,9 @@ results:
       - devguard-web-test
     kind: Pod
     result: pass
+  - policy: verify-image-signatures
+    rule: verify-devguard-postgresql-image
+    resources:
+      - postgresql-test
+    kind: Pod
+    result: pass

tests/kyverno/policies/kyverno-policy.yaml

@@ -2,7 +2,7 @@ apiVersion: kyverno.io/v1
 kind: Policy
 metadata:
   name: verify-image-signatures
-  namespace: devguard
+  namespace: default
   annotations:
     policies.kyverno.io/title: Verify Image Signatures
     policies.kyverno.io/category: Software Supply Chain Security
@@ -54,9 +54,11 @@ spec:
                     - key: "{{ predicate.runDetails.builder.id }}"
                       operator: Equals
                       value: "devguard.org"
-                    - key: "{{ contains(predicate.buildDefinition.externalParameters.remotes, 'https://github.com/l3montree-dev/devguard') }}"
-                      operator: Equals
-                      value: true
+                    - key: "{{ predicate.buildDefinition.externalParameters.remotes }}"
+                      operator: AnyIn
+                      value:
+                        - "https://github.com/l3montree-dev/devguard"
+                        - "https://github.com/l3montree-dev/devguard-web"
                     # personal email addresses from maintainers - those are
                     # hardcoded because we don't want to allow any other maintainers to sign the images
                     # numeric GitHub user IDs in noreply emails are permanent even if username changes

tests/kyverno/resources/pod-devguard-web.yaml

@@ -6,4 +6,4 @@ metadata:
 spec:
   containers:
     - name: devguard-web
-      image: ghcr.io/l3montree-dev/devguard-web:main-01c6e761-1773761560@sha256:bf2a9efcd36b158011775126a57a1a2e814286858690918289e974baa50ea7c3
+      image: ghcr.io/l3montree-dev/devguard-web:main-01c6e761-1773761560

tests/kyverno/resources/pod-devguard.yaml

@@ -6,4 +6,4 @@ metadata:
 spec:
   containers:
     - name: devguard
-      image: ghcr.io/l3montree-dev/devguard:main-latest@sha256:3f73f656067e25bcf0ff6d62aaff2834f1c8f7d55261d5dbb866abb0f1d2124f
+      image: ghcr.io/l3montree-dev/devguard:main-latest

tests/kyverno/resources/pod-postgresql.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: postgresql-test
+  namespace: default
+spec:
+  containers:
+    - name: postgresql
+      image: ghcr.io/l3montree-dev/devguard/postgresql:v1.1.0