fix: csi is an allowed volume type

Signed-off-by: Joe Bowbeer <[email protected]>
aquasecurity · Dec 11, 2023 · 08234b9 · 08234b9
1 parent cc507c7
commit 08234b9
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/checks/kubernetes/pss/restricted/1_non_core_volume_types.rego b/checks/kubernetes/pss/restricted/1_non_core_volume_types.rego
@@ -51,7 +51,6 @@ disallowed_volume_types = [
 	"portworxVolume",
 	"scaleIO",
 	"storageos",
-	"csi",
 ]
 
 # getDisallowedVolumes returns a list of volume names
@@ -71,6 +70,6 @@ failVolumeTypes {
 
 deny[res] {
 	failVolumeTypes
-	msg := kubernetes.format(sprintf("%s '%s' should set 'spec.volumes[*]' to type 'PersistentVolumeClaim'", [kubernetes.kind, kubernetes.name]))
+	msg := kubernetes.format(sprintf("%s '%s' should set 'spec.volumes[*]' to an allowed volume type", [kubernetes.kind, kubernetes.name]))
 	res := result.new(msg, input.spec)
 }
diff --git a/checks/kubernetes/pss/restricted/1_non_core_volume_types_test.rego b/checks/kubernetes/pss/restricted/1_non_core_volume_types_test.rego
@@ -31,7 +31,7 @@ test_disallowed_volume_type_used_denied {
 	}
 
 	count(r) == 1
-	r[_].msg == "Pod 'hello-volume-types' should set 'spec.volumes[*]' to type 'PersistentVolumeClaim'"
+	r[_].msg == "Pod 'hello-volume-types' should set 'spec.volumes[*]' to an allowed volume type"
 }
 
 test_no_volume_type_used_allowed {