policy-test: init test runner

Author: davidweisse

cli/cmd/generate.go

@@ -225,7 +225,7 @@ func runGenerate(cmd *cobra.Command, args []string) error {
 			return nil
 		})
 	}
-	if err := manipulateInitdata(fileMap, initdataManipulators...); err != nil {
+	if err := ManipulateInitdata(fileMap, initdataManipulators...); err != nil {
 		return fmt.Errorf("manipulate initdata: %w", err)
 	}
 

cli/cmd/policies.go

@@ -17,7 +17,8 @@ import (
 	applymetav1 "k8s.io/client-go/applyconfigurations/meta/v1"
 )
 
-func manipulateInitdata(fileMap map[string][]*unstructured.Unstructured, manipulators ...func(*initdata.Initdata) error) error {
+// ManipulateInitdata applies the given manipulators to the initdata of all workloads in the given file map.
+func ManipulateInitdata(fileMap map[string][]*unstructured.Unstructured, manipulators ...func(*initdata.Initdata) error) error {
 	return mapContrastWorkloads(fileMap, func(res any, path string, _ int) (resource any, retErr error) {
 		return kuberesource.MapPodSpecWithMeta(res, func(meta *applymetav1.ObjectMetaApplyConfiguration, spec *applycorev1.PodSpecApplyConfiguration) (*applymetav1.ObjectMetaApplyConfiguration, *applycorev1.PodSpecApplyConfiguration) {
 			if meta == nil {

go.work

@@ -6,6 +6,7 @@ use (
 	./imagepuller
 	./imagestore
 	./initdata-processor
+	./policy-test
 	./service-mesh
 	./tools/debugshell
 	./tools/fifo

justfile

@@ -554,6 +554,13 @@ lint:
 unit:
     CGO_ENABLED=1 go test -tags=contrast_unstable_api -v -race ./...
 
+# Run the policy test suite.
+policy: initializer
+    #!/usr/bin/env bash
+    set -euo pipefail
+    echo "Running policy tests..."
+    nix run -L .#base.policy-test -- --image-replacements ./{{ workspace_dir }}/just.containerlookup
+
 # Check links.
 check-links config="external":
     nix run .#base.nixpkgs.lychee -- --config tools/lychee/config-{{ config }}.toml .

packages/by-name/policy-test/package.nix

@@ -0,0 +1,56 @@
+# Copyright 2026 Edgeless Systems GmbH
+# SPDX-License-Identifier: BUSL-1.1
+
+{
+  lib,
+  buildGoModule,
+  contrast,
+}:
+
+buildGoModule (_finalAttrs: {
+  pname = "policy-test";
+  version = builtins.readFile ../../../version.txt;
+
+  inherit (contrast.cli)
+    preConfigure
+    postConfigure
+    ;
+
+  src =
+    let
+      inherit (lib) fileset path;
+      root = ../../../.;
+    in
+    fileset.toSource {
+      inherit root;
+      fileset = fileset.unions [
+        (path.append root "go.mod")
+        (path.append root "go.sum")
+        (fileset.difference (path.append root "policy-test") (path.append root "policy-test/testdata"))
+        (path.append root "cli")
+        (path.append root "internal")
+        (path.append root "sdk")
+        (path.append root "apitypes")
+      ];
+    };
+
+  proxyVendor = true;
+  vendorHash = "sha256-Cob7OieQcJBSc4L4j9X2vi0AYaPU4JdB9Jt8QhIJSk4=";
+
+  # The preConfigure and postConfigure hooks from the cli package work on the repository root, so setting
+  # either sourceRoot or modRoot would break the build. Instead, cd into the subdir here.
+  preBuild = ''
+    cd policy-test
+  '';
+
+  env.CGO_ENABLED = 0;
+  dontFixup = true;
+
+  ldflags = [
+    "-s"
+  ];
+
+  tags = [ "contrast_unstable_api" ];
+
+  meta = lib.contrast.ourMeta { mainProgram = "policy-test"; };
+})

packages/scripts.nix

@@ -68,6 +68,8 @@
       nix-update --version=skip --flake legacyPackages.x86_64-linux.base.imagepuller-benchmark
       echo "Updating vendorHash of kernelconfig package" >&2
       nix-update --version=skip --flake legacyPackages.x86_64-linux.base.kernelconfig
+      echo "Updating vendorHash of policy-test package" >&2
+      nix-update --version=skip --flake legacyPackages.x86_64-linux.base.policy-test
       echo "Updating src hash of kata.release-tarball" >&2
       ./packages/by-name/kata/release-tarball/update.sh
 

policy-test/assets/pod.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  labels:
+    # Contrast generate expects at least one Coordinator policy hash
+    contrast.edgeless.systems/pod-role: coordinator
+spec:
+  containers:
+    - name: test
+      image: busybox@sha256:dc2d74b28e4cf8984fa52af1f39bc7c3d9c73760b41a74d629f5d11b1ab28616
+      command: ["sh", "-c", "sleep inf"]
+  restartPolicy: Always
+  runtimeClassName: contrast-cc

policy-test/go.mod

@@ -0,0 +1,112 @@
+module github.com/edgelesssys/contrast/policy-test
+
+go 1.25.6
+
+replace github.com/edgelesssys/contrast => ../
+
+replace github.com/google/go-tdx-guest => github.com/edgelesssys/go-tdx-guest v0.0.0-20260625102850-ea481d3db249
+
+replace github.com/google/go-sev-guest => github.com/edgelesssys/go-sev-guest v0.0.0-20260729130516-c98bf131aac5
+
+require (
+	github.com/edgelesssys/contrast v1.22.0
+	github.com/evanphx/json-patch/v5 v5.9.11
+	github.com/open-policy-agent/opa v1.18.2
+	github.com/spf13/cobra v1.10.2
+	k8s.io/apimachinery v0.35.2
+)
+
+require (
+	filippo.io/nistec v0.0.4 // indirect
+	github.com/agnivade/levenshtein v1.2.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.6 // indirect
+	github.com/go-openapi/swag v0.26.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.26.1 // indirect
+	github.com/go-openapi/swag/conv v0.26.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.26.1 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.26.1 // indirect
+	github.com/go-openapi/swag/loading v0.26.1 // indirect
+	github.com/go-openapi/swag/mangling v0.26.1 // indirect
+	github.com/go-openapi/swag/netutils v0.26.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.26.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.26.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.26.1 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/goccy/go-json v0.10.6 // indirect
+	github.com/google/gnostic-models v0.7.1 // indirect
+	github.com/google/go-containerregistry v0.21.2 // indirect
+	github.com/google/go-sev-guest v0.14.2-0.20251119154202-af1c107a648f // indirect
+	github.com/google/go-tdx-guest v0.3.2-0.20260104162950-32866d7a678f // indirect
+	github.com/google/logger v1.1.2 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
+	github.com/lestrrat-go/dsig v1.2.1 // indirect
+	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect
+	github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
+	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
+	github.com/mdlayher/socket v0.6.1 // indirect
+	github.com/mdlayher/vsock v1.2.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/regclient/regclient v0.11.5 // indirect
+	github.com/segmentio/asm v1.2.1 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
+	github.com/valyala/fastjson v1.6.10 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.34 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/yashtewari/glob-intersection v0.2.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect
+	google.golang.org/grpc v1.82.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.35.2 // indirect
+	k8s.io/client-go v0.35.2 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)