feat: mount-volumes-for-ephemeral-containers policy

[Darkhood148]

Related Issue(s)

#1088

Description

This PR adds a sample policy to mount volumes and set default security context for ephemeral containers; along with chainsaw tests for the same

Checklist

• I have read the policy contribution guidelines.
• I have added test manifests and resources covering both positive and negative tests that prove this policy works as intended.
• I have added the artifacthub-pkg.yml file and have verified it is complete and correct.

[Darkhood148]

Hi @realshuting,

The description of the chainsaw tests is as follows:

• Step 1: Create the policy
• Step 2: Create a pod with the label ephemeral-debug: true and verify that the volume is added to the pod
• Step 3: Verify the security context of a newly created ephemeral container by ensuring that it is a read-only file system
• Step 4: Check if volumeMounts are being correctly added

[realshuting]

I don't see this is checked in chainsaw-test.yaml, can we add it?

[Darkhood148]

I verified it by attempting to create a file and checking if it was actually being created or not (as it is read-only file system). Should I check it directly instead?

[realshuting]

Can you point me to it?

[Darkhood148]

Line 36-38 in chainsaw-test.yaml

[Darkhood148]

@realshuting 😅