Update disallow-helm-tiller and disallow-latest-tag to include all container types in a pod

best-practices/disallow-helm-tiller/.chainsaw-test/bad-deploy.yaml

@@ -19,3 +19,8 @@ spec:
         name: busybox
       - image: docker.io/tiller:latest
         name: helm-tiller
+      initContainers:
+      - image: busybox
+        name: busybox
+      - image: docker.io/tiller:latest
+        name: helm-tiller

best-practices/disallow-helm-tiller/.chainsaw-test/bad-pod-fail-first.yaml

@@ -8,3 +8,8 @@ spec:
     image: docker.io/tiller:latest
   - name: somebox
     image: busybox:1.35
+  initContainers:
+  - name: helm-tiller
+    image: docker.io/tiller:latest
+  - name: somebox
+    image: busybox:1.35

best-practices/disallow-helm-tiller/.chainsaw-test/bad-pod-success-first.yaml

@@ -7,4 +7,9 @@ spec:
   - name: somebox
     image: busybox:1.35
   - name: helm-tiller
-    image: docker.io/tiller:latest
+    image: docker.io/tiller:latest
+  initContainers:
+  - name: somebox
+    image: busybox:1.35
+  - name: helm-tiller
+    image: docker.io/tiller:latest

best-practices/disallow-helm-tiller/.chainsaw-test/bad-pod.yaml

@@ -5,4 +5,7 @@ metadata:
 spec:
   containers:
   - name: helm-tiller
-    image: docker.io/tiller:latest
+    image: docker.io/tiller:latest
+  initContainers:
+  - name: helm-tiller
+    image: docker.io/tiller:latest

best-practices/disallow-helm-tiller/.chainsaw-test/good-deploy.yaml

@@ -17,4 +17,8 @@ spec:
       containers:
       - image: busybox:v1.35
         name: busybox
-        command: ["sleep", "3600"]
+        command: ["sleep", "3600"]
+      initContainers:
+      - image: busybox:v1.35
+        name: busybox
+        command: ["sleep", "3600"]

best-practices/disallow-helm-tiller/.chainsaw-test/good-pod.yaml

@@ -7,4 +7,9 @@ spec:
   - name: busybox
     image: busybox:v1.35
   - name: nothelmbox
-    image: busybox:v1.35
+    image: busybox:v1.35
+  initContainers:
+  - name: busybox
+    image: busybox:v1.35
+  - name: nothelmbox
+    image: busybox:v1.35

best-practices/disallow-helm-tiller/artifacthub-pkg.yml

@@ -18,4 +18,4 @@ readme: |
 annotations:
   kyverno/category: "Sample"
   kyverno/subject: "Pod"
-digest: 6de64a4a8d611c250dc0190b28b6c757db531063161531e4f68202c0fbda5be4
+digest: 3d92f3a2949283ad6d9baa99565e407c5cd78d015e0220750de522ac40ce1de2

best-practices/disallow-helm-tiller/disallow-helm-tiller.yaml

@@ -11,7 +11,7 @@ metadata:
     policies.kyverno.io/description: >-
       Tiller, found in Helm v2, has known security challenges. It requires administrative privileges and acts as a shared
       resource accessible to any authenticated user. Tiller can lead to privilege escalation as
-      restricted users can impact other users. It is recommend to use Helm v3+ which does not contain
+      restricted users can impact other users. It is recommended to use Helm v3+ which does not contain
       Tiller for these reasons. This policy validates that there is not an image
       containing the name `tiller`.
 spec:
@@ -26,8 +26,13 @@ spec:
               - Pod
       validate:
         message: "Helm Tiller is not allowed"
-        pattern:
-          spec:
-            containers:
-              - name: "*"
-                image: "!*tiller*"
+        foreach:
+        - list: "request.object.spec.containers"
+          pattern:
+            image: "!*tiller*"
+        - list: "request.object.spec.initContainers"
+          pattern:
+            image: "!*tiller*"
+        - list: "request.object.spec.ephemeralContainers"
+          pattern:
+            image: "!*tiller*"

best-practices/disallow-latest-tag/.chainsaw-test/bad-pod-latest-fail-first.yaml

@@ -7,4 +7,9 @@ spec:
   - name: busybox
     image: busybox:latest
   - name: nginx
-    image: nginx:1.35
+    image: nginx:1.35
+  initContainers:
+  - name: busybox
+    image: busybox:latest
+  - name: nginx
+    image: nginx:1.35

best-practices/disallow-latest-tag/.chainsaw-test/bad-pod-latest-success-first.yaml

@@ -7,4 +7,9 @@ spec:
   - name: nginx
     image: nginx:1.35
   - name: busybox
-    image: busybox:latest
+    image: busybox:latest
+  initContainers:
+  - name: nginx
+    image: nginx:1.35
+  - name: busybox
+    image: busybox:latest

best-practices/disallow-latest-tag/.chainsaw-test/bad-pod-no-tag.yaml

@@ -8,6 +8,11 @@ spec:
     image: busybox
   - name: nginx
     image: nginx:1.35
+  initContainers:
+  - name: busybox
+    image: busybox
+  - name: nginx
+    image: nginx:1.35
 ---
 apiVersion: v1
 kind: Pod
@@ -19,6 +24,11 @@ spec:
     image: nginx:1.35
   - name: busybox
     image: busybox
+  initContainers:
+  - name: nginx
+    image: nginx:1.35
+  - name: busybox
+    image: busybox
 ---
 apiVersion: v1
 kind: Pod
@@ -29,4 +39,9 @@ spec:
   - name: busybox
     image: busybox
   - name: nginx
-    image: nginx:latest
+    image: nginx:latest
+  initContainers:
+  - name: busybox
+    image: busybox
+  - name: nginx
+    image: nginx:latest

best-practices/disallow-latest-tag/.chainsaw-test/good-pod.yaml

@@ -5,4 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox
-    image: busybox:v1.35
+    image: busybox:v1.35
+  initContainers:
+  - name: busybox
+    image: busybox:v1.35

best-practices/disallow-latest-tag/artifacthub-pkg.yml

@@ -18,4 +18,4 @@ readme: |
 annotations:
   kyverno/category: "Best Practices"
   kyverno/subject: "Pod"
-digest: 3d19e0d8f2637eca9ad1d700f4fbf556aaa31221ff6c40698b9aadda1f41adb4
+digest: 3e299e0f018ff57ee78cfff4119df58d72e11669908eff9dfe8294f3be7a6e60

best-practices/disallow-latest-tag/disallow-latest-tag.yaml

@@ -25,10 +25,16 @@ spec:
           - Pod
     validate:
       message: "An image tag is required."
-      pattern:
-        spec:
-          containers:
-          - image: "*:*"
+      foreach:
+        - list: "request.object.spec.containers"
+          pattern:
+            image: "*:*"
+        - list: "request.object.spec.initContainers"
+          pattern:
+            image: "*:*"
+        - list: "request.object.spec.ephemeralContainers"
+          pattern:
+            image: "*:*"
   - name: validate-image-tag
     match:
       any:
@@ -37,7 +43,13 @@ spec:
           - Pod
     validate:
       message: "Using a mutable image tag e.g. 'latest' is not allowed."
-      pattern:
-        spec:
-          containers:
-          - image: "!*:latest"
+      foreach:
+        - list: "request.object.spec.containers"
+          pattern:
+            image: "!*:latest"
+        - list: "request.object.spec.initContainers"
+          pattern:
+            image: "!*:latest"
+        - list: "request.object.spec.ephemeralContainers"
+          pattern:
+            image: "!*:latest"