kyverno · MariamFahmy98 · Jun 3, 2024 · Mar 6, 2024 · Mar 6, 2024 · Mar 6, 2024
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/chainsaw-test.yaml
@@ -48,3 +48,4 @@ spec:
         file: pod-emptydir-vol.yaml
     - apply:
         file: pod-no-volumes.yaml
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/good-pod.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/good-pod.yaml
@@ -13,3 +13,4 @@ spec:
   - name: data
     hostPath:
       path: /data
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-containerd-sock.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-containerd-sock.yaml
@@ -13,3 +13,4 @@ spec:
   - name: dockersock
     hostPath:
       path: /var/run/containerd/containerd.sock
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-cri-dockerd-sock.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-cri-dockerd-sock.yaml
@@ -13,3 +13,4 @@ spec:
   - name: dockersock
     hostPath:
       path: /var/run/cri-dockerd.sock
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-crio-sock.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-crio-sock.yaml
@@ -13,3 +13,4 @@ spec:
   - name: dockersock
     hostPath:
       path: /var/run/crio/crio.sock
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-docker-sock.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-docker-sock.yaml
@@ -13,3 +13,4 @@ spec:
   - name: dockersock
     hostPath:
       path: /var/run/docker.sock
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-emptydir-vol.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-emptydir-vol.yaml
@@ -12,3 +12,4 @@ spec:
   volumes:
     - name: mydir
       emptyDir: {}
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-no-volumes.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-no-volumes.yaml
@@ -10,3 +10,4 @@ spec:
     command:
     - sleep
     - "3600"
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/policy-ready.yaml b/best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: disallow-container-sock-mounts
 status:
   ready: true
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.kyverno-test/kyverno-test.yaml b/best-practices-cel/disallow-cri-sock-mount/.kyverno-test/kyverno-test.yaml
@@ -19,3 +19,4 @@ results:
   - goodpod01
   result: pass
   rule: validate-socket-mounts
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/.kyverno-test/resource.yaml b/best-practices-cel/disallow-cri-sock-mount/.kyverno-test/resource.yaml
@@ -29,3 +29,4 @@ spec:
   - name: data
     hostPath:
       path: /data
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/artifacthub-pkg.yml b/best-practices-cel/disallow-cri-sock-mount/artifacthub-pkg.yml
@@ -22,3 +22,4 @@ annotations:
   kyverno/subject: "Pod"
 digest: 13b89552586f92ba707fbb1b4daf9751acb28e3eb7cfd5d85ef1c799665e22c5
 createdAt: "2024-03-14T15:59:52Z"
+
diff --git a/best-practices-cel/disallow-cri-sock-mount/disallow-cri-sock-mount.yaml b/best-practices-cel/disallow-cri-sock-mount/disallow-cri-sock-mount.yaml
@@ -55,3 +55,4 @@ spec:
               variables.hasVolumes || 
               variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/cri-dockerd.sock'))
             message: "Use of the Docker CRI socket is not allowed."
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/chainsaw-test.yaml
@@ -53,3 +53,4 @@ spec:
         - check:
             ($error != null): true
         file: deploy-default.yaml
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/deploy-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/deploy-default.yaml
@@ -21,3 +21,4 @@ spec:
         command:
         - "sleep"
         - "3000"
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/ds-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/ds-default.yaml
@@ -18,3 +18,4 @@ spec:
         command:
         - "sleep"
         - "3000"
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/good-resources.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/good-resources.yaml
@@ -95,3 +95,4 @@ spec:
         command:
         - "sleep"
         - "3000"
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/job-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/job-default.yaml
@@ -13,3 +13,4 @@ spec:
         - "sleep"
         - "3000"
       restartPolicy: Never
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/ns.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/ns.yaml
@@ -2,3 +2,4 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: not-default-ns
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/pod-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/pod-default.yaml
@@ -10,3 +10,4 @@ spec:
     command:
     - "sleep"
     - "3000"
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/policy-ready.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: disallow-default-namespace
 status:
   ready: true
+
diff --git a/best-practices-cel/disallow-default-namespace/.chainsaw-test/ss-default.yaml b/best-practices-cel/disallow-default-namespace/.chainsaw-test/ss-default.yaml
@@ -21,3 +21,4 @@ spec:
         command:
         - "sleep"
         - "3000"
+
diff --git a/best-practices-cel/disallow-default-namespace/.kyverno-test/kyverno-test.yaml b/best-practices-cel/disallow-default-namespace/.kyverno-test/kyverno-test.yaml
@@ -31,3 +31,4 @@ results:
   - gooddeployment01
   result: pass
   rule: validate-podcontroller-namespace
+
diff --git a/best-practices-cel/disallow-default-namespace/.kyverno-test/resource.yaml b/best-practices-cel/disallow-default-namespace/.kyverno-test/resource.yaml
@@ -64,3 +64,4 @@ spec:
       - image: busybox:1.28
         name: busybox
         command: ["sleep", "9999"]
+
diff --git a/best-practices-cel/disallow-default-namespace/artifacthub-pkg.yml b/best-practices-cel/disallow-default-namespace/artifacthub-pkg.yml
@@ -21,3 +21,4 @@ annotations:
   kyverno/subject: "Pod"
 digest: 32bf42d3e6ee89012153c823e3b52e78ac561b6a7dd6e588643228501ae14cad
 createdAt: "2024-03-08T06:15:05Z"
+
diff --git a/best-practices-cel/disallow-default-namespace/disallow-default-namespace.yaml b/best-practices-cel/disallow-default-namespace/disallow-default-namespace.yaml
@@ -47,3 +47,4 @@ spec:
         expressions:
           - expression: "object.metadata.namespace != 'default'"
             message: "Using 'default' namespace is not allowed for pod controllers."
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/chainsaw-test.yaml
@@ -39,3 +39,4 @@ spec:
         - check:
             ($error != null): true
         file: no-host-success-first.yaml
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/good-ingress.yaml b/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/good-ingress.yaml
@@ -24,3 +24,4 @@ spec:
             name: service2
             port:
               number: 80
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/no-host-fail-first.yaml b/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/no-host-fail-first.yaml
@@ -23,3 +23,4 @@ spec:
             name: service2
             port:
               number: 80
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/no-host-ingress.yaml b/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/no-host-ingress.yaml
@@ -15,3 +15,4 @@ spec:
             name: test
             port:
               number: 80
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/no-host-success-first.yaml b/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/no-host-success-first.yaml
@@ -23,3 +23,4 @@ spec:
             name: service2
             port:
               number: 80
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/policy-ready.yaml b/best-practices-cel/disallow-empty-ingress-host/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: disallow-empty-ingress-host
 status:
   ready: true
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.kyverno-test/kyverno-test.yaml b/best-practices-cel/disallow-empty-ingress-host/.kyverno-test/kyverno-test.yaml
@@ -19,3 +19,4 @@ results:
   - ingress-wildcard-host
   result: pass
   rule: disallow-empty-ingress-host
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/.kyverno-test/resource.yaml b/best-practices-cel/disallow-empty-ingress-host/.kyverno-test/resource.yaml
@@ -42,3 +42,4 @@ spec:
             name: test
             port:
               number: 80
+
diff --git a/best-practices-cel/disallow-empty-ingress-host/artifacthub-pkg.yml b/best-practices-cel/disallow-empty-ingress-host/artifacthub-pkg.yml
@@ -21,3 +21,4 @@ annotations:
   kyverno/subject: "Ingress"
 digest: 9cb3d5814cea4a34de185ce8fd469762a83ef93b910e70b2e6a9ec953e65448c
 createdAt: "2024-03-09T14:19:51Z"
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-deploy.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-deploy.yaml
@@ -19,3 +19,4 @@ spec:
         name: busybox
       - image: docker.io/tiller:latest
         name: helm-tiller
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-fail-first.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-fail-first.yaml
@@ -8,3 +8,4 @@ spec:
     image: docker.io/tiller:latest
   - name: somebox
     image: busybox:1.35
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-success-first.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod-success-first.yaml
@@ -8,3 +8,4 @@ spec:
     image: busybox:1.35
   - name: helm-tiller
     image: docker.io/tiller:latest
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/bad-pod.yaml
@@ -6,3 +6,4 @@ spec:
   containers:
   - name: helm-tiller
     image: docker.io/tiller:latest
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/chainsaw-test.yaml
@@ -46,3 +46,4 @@ spec:
         - check:
             ($error != null): true
         file: bad-pod-success-first.yaml
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-deploy.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-deploy.yaml
@@ -18,3 +18,4 @@ spec:
       - image: busybox:v1.35
         name: busybox
         command: ["sleep", "3600"]
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-pod.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/good-pod.yaml
@@ -8,3 +8,4 @@ spec:
     image: busybox:v1.35
   - name: nothelmbox
     image: busybox:v1.35
+
diff --git a/best-practices-cel/disallow-helm-tiller/.chainsaw-test/policy-ready.yaml b/best-practices-cel/disallow-helm-tiller/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: disallow-helm-tiller
 status:
   ready: true
+
diff --git a/best-practices-cel/disallow-helm-tiller/.kyverno-test/kyverno-test.yaml b/best-practices-cel/disallow-helm-tiller/.kyverno-test/kyverno-test.yaml
@@ -33,3 +33,4 @@ results:
   - goodpod02
   result: pass
   rule: validate-helm-tiller
+
diff --git a/best-practices-cel/disallow-helm-tiller/.kyverno-test/resource.yaml b/best-practices-cel/disallow-helm-tiller/.kyverno-test/resource.yaml
@@ -80,3 +80,4 @@ spec:
       containers:
       - image: docker.io/tiller:latest
         name: helm-tiller
+
diff --git a/best-practices-cel/disallow-helm-tiller/artifacthub-pkg.yml b/best-practices-cel/disallow-helm-tiller/artifacthub-pkg.yml
@@ -21,3 +21,4 @@ annotations:
   kyverno/subject: "Pod"
 digest: 68bd8e1cf068759dc436032f3bcb1204992b84ba33498ffd76b744329976769e
 createdAt: "2024-03-08T06:30:37Z"
+
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-fail-first.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-fail-first.yaml
@@ -8,3 +8,4 @@ spec:
     image: busybox:latest
   - name: nginx
     image: nginx:1.35
+
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-success-first.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-latest-success-first.yaml
@@ -8,3 +8,4 @@ spec:
     image: nginx:1.35
   - name: busybox
     image: busybox:latest
+
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-no-tag.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/bad-pod-no-tag.yaml
@@ -30,3 +30,4 @@ spec:
     image: busybox
   - name: nginx
     image: nginx:latest
+
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/chainsaw-test.yaml
@@ -39,3 +39,4 @@ spec:
         - check:
             ($error != null): true
         file: bad-pod-no-tag.yaml
+
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/good-pod.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/good-pod.yaml
@@ -6,3 +6,4 @@ spec:
   containers:
   - name: busybox
     image: busybox:v1.35
+
diff --git a/best-practices-cel/disallow-latest-tag/.chainsaw-test/policy-ready.yaml b/best-practices-cel/disallow-latest-tag/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: disallow-latest-tag
 status:
   ready: true
+
diff --git a/best-practices-cel/disallow-latest-tag/.kyverno-test/kyverno-test.yaml b/best-practices-cel/disallow-latest-tag/.kyverno-test/kyverno-test.yaml
@@ -57,3 +57,4 @@ results:
   - myapp-pod
   result: pass
   rule: validate-image-tag
+
diff --git a/best-practices-cel/disallow-latest-tag/.kyverno-test/resource.yaml b/best-practices-cel/disallow-latest-tag/.kyverno-test/resource.yaml
@@ -119,3 +119,4 @@ spec:
       - image: busybox:latest
         name: busybox
         command: ["sleep", "9999"]
+
diff --git a/best-practices-cel/disallow-latest-tag/artifacthub-pkg.yml b/best-practices-cel/disallow-latest-tag/artifacthub-pkg.yml
@@ -21,3 +21,4 @@ annotations:
   kyverno/subject: "Pod"
 digest: 53f55b5f8e66068be9c7db000ca45ce3e66cadd4ab8c4cbab5e07eaa9736b551
 createdAt: "2024-03-07T20:17:11Z"
+
diff --git a/best-practices-cel/disallow-latest-tag/disallow-latest-tag.yaml b/best-practices-cel/disallow-latest-tag/disallow-latest-tag.yaml
@@ -40,3 +40,4 @@ spec:
         expressions:
           - expression: "object.spec.containers.all(container, !container.image.endsWith(':latest'))"
             message: "Using a mutable image tag e.g. 'latest' is not allowed."
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-containers.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-containers.yaml
@@ -59,3 +59,4 @@ spec:
         add: ["SYS_TIME"]
         drop:
           - ALL
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-corner.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-corner.yaml
@@ -52,3 +52,4 @@ spec:
           - ALL
   - name: init-again
     image: busybox:1.35
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-initcontainers.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-pod-initcontainers.yaml
@@ -45,3 +45,4 @@ spec:
         add: ["SYS_TIME"]
         drop:
           - ALL
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/bad-podcontrollers.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/bad-podcontrollers.yaml
@@ -151,3 +151,4 @@ spec:
                   - ALL
           - name: add-capabilities-again
             image: busybox:1.35
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/chainsaw-test.yaml
@@ -46,3 +46,4 @@ spec:
         - check:
             ($error != null): true
         file: bad-podcontrollers.yaml
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/good-pod.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/good-pod.yaml
@@ -25,3 +25,4 @@ spec:
         add: ["SYS_TIME"]
         drop:
           - ALL
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/good-podcontrollers.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/good-podcontrollers.yaml
@@ -84,3 +84,4 @@ spec:
                 add: ["SYS_TIME"]
                 drop:
                   - ALL
+
diff --git a/best-practices-cel/require-drop-all/.chainsaw-test/policy-ready.yaml b/best-practices-cel/require-drop-all/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: drop-all-capabilities
 status:
   ready: true
+
diff --git a/best-practices-cel/require-drop-all/.kyverno-test/kyverno-test.yaml b/best-practices-cel/require-drop-all/.kyverno-test/kyverno-test.yaml
@@ -19,3 +19,4 @@ results:
   - add-capabilities
   result: pass
   rule: require-drop-all
+
diff --git a/best-practices-cel/require-drop-all/.kyverno-test/resource.yaml b/best-practices-cel/require-drop-all/.kyverno-test/resource.yaml
@@ -35,3 +35,4 @@ spec:
         add: ["SYS_TIME"]
         drop:
           - ALL
+
diff --git a/best-practices-cel/require-drop-all/artifacthub-pkg.yml b/best-practices-cel/require-drop-all/artifacthub-pkg.yml
@@ -21,3 +21,4 @@ annotations:
   kyverno/subject: "Pod"
 digest: 1261431a3050aa2ef8958728e13655e6570046366ed22d0b5a62d45c2584fe0a
 createdAt: "2024-03-10T05:05:42Z"
+
diff --git a/best-practices-cel/require-drop-all/require-drop-all.yaml b/best-practices-cel/require-drop-all/require-drop-all.yaml
@@ -41,3 +41,4 @@ spec:
                 has(container.securityContext.capabilities.drop) &&
                 container.securityContext.capabilities.drop.exists(capability, capability.upperAscii() == 'ALL'))
               message: "Containers must drop `ALL` capabilities."
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-pod-containers.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-pod-containers.yaml
@@ -59,3 +59,4 @@ spec:
         add: ["SYS_TIME"]
         drop:
           - CAP_NET_RAW
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-pod-corner.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-pod-corner.yaml
@@ -49,3 +49,4 @@ spec:
           - CAP_NET_RAW
   - name: init-again
     image: busybox:1.35
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-pod-initcontainers.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-pod-initcontainers.yaml
@@ -45,3 +45,4 @@ spec:
         add: ["SYS_TIME"]
         drop:
           - CAP_NET_RAW
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-podcontrollers.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/bad-podcontrollers.yaml
@@ -151,3 +151,4 @@ spec:
                   - CAP_NET_RAW
           - name: add-capabilities-again
             image: busybox:1.35
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/chainsaw-test.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/chainsaw-test.yaml
@@ -46,3 +46,4 @@ spec:
         - check:
             ($error != null): true
         file: bad-podcontrollers.yaml
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/good-pod.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/good-pod.yaml
@@ -23,3 +23,4 @@ spec:
       capabilities:
         drop:
           - CAP_NET_RAW
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/good-podcontrollers.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/good-podcontrollers.yaml
@@ -84,3 +84,4 @@ spec:
                 add: ["SYS_TIME"]
                 drop:
                   - CAP_NET_RAW
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/policy-ready.yaml b/best-practices-cel/require-drop-cap-net-raw/.chainsaw-test/policy-ready.yaml
@@ -4,3 +4,4 @@ metadata:
   name: drop-cap-net-raw
 status:
   ready: true
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.kyverno-test/kyverno-test.yaml b/best-practices-cel/require-drop-cap-net-raw/.kyverno-test/kyverno-test.yaml
@@ -20,3 +20,4 @@ results:
   - drop-good
   result: pass
   rule: require-drop-cap-net-raw
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/.kyverno-test/resource.yaml b/best-practices-cel/require-drop-cap-net-raw/.kyverno-test/resource.yaml
@@ -42,3 +42,4 @@ spec:
   containers:
   - name: add-capabilities
     image: gcr.io/google-samples/node-hello:1.0
+
diff --git a/best-practices-cel/require-drop-cap-net-raw/artifacthub-pkg.yml b/best-practices-cel/require-drop-cap-net-raw/artifacthub-pkg.yml
@@ -21,3 +21,4 @@ annotations:
   kyverno/subject: "Pod"
 digest: 7825bfca95447946cecd4b65b758f1045fd5770eced2fb20e8f8a443bc27598a
 createdAt: "2024-03-15T03:05:47Z"
+
diff --git a/best-practices-cel/require-labels/.chainsaw-test/bad-pod-nolabel.yaml b/best-practices-cel/require-labels/.chainsaw-test/bad-pod-nolabel.yaml
@@ -6,3 +6,4 @@ spec:
   containers:
   - name: busybox
     image: busybox:1.35
+