unit tests for 'Dockerfile' OPA policies

[kandulaphani]

Hi,
Looking for some help in writing unit tests for the Dockerfile OPA policies in order to increase the code coverage as much as can. I'm new to rego language, hence this ask. It would be great if someone can help me get started with...Thanks!

Unit tests for Dockerfile instructions such as

entrypoints[x] {
lower(input[i].Cmd) == lower("entrypoint")
x := input[i]
}
exposed_ports[x] {
lower(input[i].Cmd) == lower("expose")
x := input[i]
}

users
copy_commands
add_commands
is_root_user
valid_port
command_array
get_ports ...etc.,

[peteroneilljr]

Hi @kandulaphani

Are you looking to write unit tests based on what you posted above? Or you're trying to understand how to write a configuration test for a Dockerfile?

Assuming the goal is to validate your Dockerfile configuration, this article shows some really good examples: https://medium.com/miro-engineering/a-practical-guide-to-writing-secure-dockerfiles-bf561224dd80

[kandulaphani]

Hi @peteroneilljr - I am looking for some help in writing the test cases for the Dockerfile instructions as mentioned to increase the code coverage for the existing OPA policies. Thanks!

[peteroneilljr]

You rules don't have a true or a false statement to test.

Let's take this Dockerfile example

FROM ubuntu
ENTRYPOINT ["top"]
CMD ["-c"]

And this Rego rule

package docker

default allow = false 

allow {
   entrypoint == ["top"]
}

We can expect that Dockerfile to be allowed. Now we can write a unit test to verify this.

package docker.tests

test_top_allowed {
    allow with input as {"entrypoint": ["top"]}
}

test_bash_denied {
    not allow with input as {"entrypoint": ["bash"]}
}

Now these tests can be run to show your rule correctly returns allow for top and deny for bash.

[kandulaphani]

@peteroneilljr - Thank you for sharing the example, will try to start writing test cases for the existing policies and revert if need any further assistance. Much appreciated.

[kandulaphani]

Hi @peteroneilljr - is it possible to write unit tests for the library .rego file. Observed that this file is actually affecting our overall Code Coverage. Is there a way to write test cases for the below code? Thanks!

Example (code not covered):

}

users[x] {
lower(input[i].Cmd) == lower("user")
x := input[i]
}

copy_commands[x] {
lower(input[i].Cmd) == lower("copy")
x := input[i]
}

[kandulaphani]

Hi @peteroneilljr - Thank you.

Please find one of the conditions below from the library .rego file

exposed_ports[x] {
	lower(input[i].Cmd) == lower("expose")
	x := input[i]
}

and, I have written the code as below for the _test.rego file, but its only covering the line lower(input[i].Cmd) == lower("expose") when I execute opa test --coverage --format=json

package policy.library.docker

test_exposed_ports_allowed {
	exposed_ports with input as {"Cmd": "expose", "Value": {"1000/tcp": "true"}}
}

test_exposed_ports_denied {
	exposed_ports with input as {"Cmd": "expose", "Value": {"2000/tcp": "false"}}
}

We have a few OPA dockerfile policies, and each policy has main.rego and main_test.rego files (no issues with the coverage), but we use a common library rego file that doesn't have unit tests covered and which is affecting overall coverage. I am in the process of writing unit tests for all the conditions in the library rego file (one example furnished above). Please advise. Thanks!

[peteroneilljr]

It sounds like you're on the right path, writing unit tests for all of your conditions. What are you specifically looking for advice on?

[kandulaphani]

@peteroneilljr - would like to understand why only one line lower(input[i].Cmd) == lower("expose") is being covered out of 3 lines. Thanks!

exposed_ports[x] {
lower(input[i].Cmd) == lower("expose")
x := input[i]

[peteroneilljr]

That line is the only line that has a comparison. The last light is a variable assignment. The first line is the rule name where you're assigning the inputs to the var exposed_ports.

[kandulaphani]

Thanks a lot @peteroneilljr