chore: add chainsaw test foreach clonelist, sync=true, delete source

Signed-off-by: ShutingZhao <[email protected]>

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/1-0-existing.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: foreach-cpol-clone-list-sync-delete-source-existing-ns
+---
+apiVersion: v1
+data:
+  foo: YmFy
+kind: Secret
+metadata:
+  labels:
+    allowedToBeCloned: "true"
+    location: europe
+  name: mysecret-1
+  namespace: foreach-cpol-clone-list-sync-delete-source-existing-ns
+type: Opaque
+---
+apiVersion: v1
+data:
+  foo: YmFy
+kind: Secret
+metadata:
+  labels:
+    allowedToBeCloned: "false"
+    location: europe
+  name: mysecret-2
+  namespace: foreach-cpol-clone-list-sync-delete-source-existing-ns
+type: Opaque
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: foreach-cpol-clone-list-sync-delete-source-target-ns-1
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: foreach-cpol-clone-list-sync-delete-source-target-ns-2
+

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/1-1-policy.yaml

@@ -0,0 +1,47 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: foreach-cpol-clone-list-sync-delete-source
+spec:
+  rules:
+  - match:
+      any:
+      - resources:
+          kinds:
+          - ConfigMap
+    name: k-kafka-address
+    context:
+    - name: configmapns
+      variable:
+        jmesPath: request.object.metadata.namespace
+    preconditions:
+      any:
+      - key: '{{configmapns}}'
+        operator: Equals
+        value: '{{request.object.metadata.namespace}}'
+    generate:
+      generateExisting: false
+      synchronize: true
+      foreach:
+        - list: request.object.data.namespaces | split(@, ',')
+          context:
+          - name: ns
+            variable:
+              jmesPath: element
+          preconditions:
+            any:
+            - key: '{{ ns }}'
+              operator: AnyIn
+              value:
+              - foreach-cpol-clone-list-sync-delete-source-target-ns-1
+          apiVersion: v1
+          kind: Secret
+          name: cloned-secret-{{ elementIndex }}-{{ ns }}
+          namespace: '{{ ns }}'
+          cloneList:
+            kinds:
+            - v1/Secret
+            namespace: foreach-cpol-clone-list-sync-delete-source-existing-ns
+            selector:
+              matchLabels:
+                allowedToBeCloned: "true"

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/1-2-policy-assert.yaml

@@ -0,0 +1,9 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterPolicy
+metadata:
+  name: foreach-cpol-clone-list-sync-delete-source
+status:
+  conditions:
+  - reason: Succeeded
+    status: "True"
+    type: Ready

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/2-1-trigger.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: foreach-cpol-clone-list-sync-delete-source-trigger-ns
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: default-deny
+  namespace: foreach-cpol-clone-list-sync-delete-source-trigger-ns
+data:
+  namespaces: foreach-cpol-clone-list-sync-delete-source-target-ns-1,foreach-cpol-clone-list-sync-delete-source-target-ns-2

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/3-1-target-expected.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+data:
+  foo: YmFy
+kind: Secret
+metadata:
+  labels:
+    allowedToBeCloned: "true"
+    location: europe
+  name: mysecret-1
+  namespace: foreach-cpol-clone-list-sync-delete-source-target-ns-1
+type: Opaque

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/3-2-target-none-expected.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+data:
+  foo: YmFy
+kind: Secret
+metadata:
+  labels:
+    allowedToBeCloned: "true"
+    location: europe
+  name: mysecret-2
+  namespace: foreach-cpol-clone-list-sync-delete-source-target-ns-2
+type: Opaque

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/README.md

@@ -0,0 +1,11 @@
+## Description
+
+This is a corner case test to ensure the corresponding downstream target is deleted when its trigger is deleted, for a generate cloneList type of policy.
+
+## Expected Behavior
+
+If the downstream resources `mysecret-1` and `mysecret-2` are remained in the namespace `cpol-clone-list-sync-delete-source-trigger-ns-2`, the test passes. If not, the test fails.
+
+## Reference Issue(s)
+
+https://github.com/kyverno/kyverno/issues/7535

test/conformance/chainsaw/generate/foreach/clusterpolicy/clone/sync/cpol-clone-list-sync-delete-source/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: cpol-clone-list-sync-delete-source
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: 1-0-existing.yaml
+    - apply:
+        file: 1-1-policy.yaml
+    - assert:
+        file: 1-2-policy-assert.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: 2-1-trigger.yaml
+  - name: step-03
+    try:
+    - assert:
+        file: 3-1-target-expected.yaml
+    - error:
+        file: 3-2-target-none-expected.yaml
+  - name: step-04
+    try:
+    - delete:
+        ref:
+          apiVersion: v1
+          kind: Secret
+          name: mysecret-1
+          namespace: foreach-cpol-clone-list-sync-delete-source-existing-ns
+  - name: step-05
+    try:
+    - error:
+        file: 3-1-target-expected.yaml