---
id: policy-kyverno-engine-deny
name: "Kyverno policy-denies-violation: engine-level assert"
description: >-
  Installs Kyverno, creates a ClusterPolicy that requires app.kubernetes.io/name label on
  Deployments, then exercises the engine-level policy-denies-violation L3 behavioral assert to
  verify violating fixtures are denied and compliant fixtures are accepted.
labels: {customer: any, profile: policy}
cluster:
  provider: kind
  k8s_version: v1.36.1
  preinstall:
    - kind: helm
      chart: kyverno/kyverno
      version: "3.8.1"
      release: kyverno
      namespace: kyverno
      repo:
        name: kyverno
        url: "https://kyverno.github.io/kyverno/"
      values:
        admissionController:
          replicas: 1
        backgroundController:
          enabled: true
        cleanupController:
          enabled: true
        reportsController:
          enabled: true
        features:
          admissionReports:
            enabled: true
          policyReports:
            enabled: true
      wait: pods-ready
      wait_timeout: 4m
    - kind: raw_manifest
      path: chart-test/fixtures/policy/kyverno-validate-require-label.yaml
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    image.repository: "public.ecr.aws/nginx/nginx"
    image.tag: "1.29-alpine"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: kyverno
    timeout: 4m
    selector: app.kubernetes.io/instance=kyverno
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: policy-denies-violation
    namespace: sample
    policy_type: kyverno
    policy_name: require-app-label
    policy_namespace: kyverno
    violating_fixture: chart-test/fixtures/policy/test-deploy-noncompliant-kyverno.yaml
    compliant_fixture: chart-test/fixtures/policy/test-deploy-compliant-kyverno.yaml
    timeout: 3m
tags: [nightly]
mechanisms: ['addon:kyverno', 'assert:policy-denies-violation']
category: policy
integration: kyverno
tier: live