Patch further static namespaces with PSS labels (#2768)

* Patched other namespaces in common with PSS labels Signed-off-by: biswajit-9776 <[email protected]> * Patched dex and oauth2-proxy namespace with PSS labels Signed-off-by: biswajit-9776 <[email protected]> --------- Signed-off-by: biswajit-9776 <[email protected]>
kubeflow · Jul 1, 2024 · 83e35d7 · 83e35d7
1 parent 38a8183
commit 83e35d7
Show file tree

Hide file tree

Showing 8 changed files with 43 additions and 1 deletion.
diff --git a/contrib/security/PSS/static/baseline/kustomization.yaml b/contrib/security/PSS/static/baseline/kustomization.yaml
@@ -4,3 +4,6 @@ kind: Component
 patches:
 - path: patches/kubeflow-labels.yaml
 - path: patches/istio-labels.yaml
+- path: patches/cert-manager-labels.yaml
+- path: patches/dex-labels.yaml
+- path: patches/oauth2-proxy-labels.yaml
diff --git a/contrib/security/PSS/static/baseline/patches/cert-manager-labels.yaml b/contrib/security/PSS/static/baseline/patches/cert-manager-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/baseline/patches/dex-labels.yaml b/contrib/security/PSS/static/baseline/patches/dex-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/baseline/patches/oauth2-proxy-labels.yaml b/contrib/security/PSS/static/baseline/patches/oauth2-proxy-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oauth2-proxy
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/restricted/kustomization.yaml b/contrib/security/PSS/static/restricted/kustomization.yaml
@@ -3,4 +3,7 @@ kind: Component
 
 patches:
 - path: patches/kubeflow-labels.yaml
-- path: patches/istio-labels.yaml
+- path: patches/istio-labels.yaml
+- path: patches/cert-manager-labels.yaml
+- path: patches/dex-labels.yaml
+- path: patches/oauth2-proxy-labels.yaml
diff --git a/contrib/security/PSS/static/restricted/patches/cert-manager-labels.yaml b/contrib/security/PSS/static/restricted/patches/cert-manager-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
diff --git a/contrib/security/PSS/static/restricted/patches/dex-labels.yaml b/contrib/security/PSS/static/restricted/patches/dex-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
diff --git a/contrib/security/PSS/static/restricted/patches/oauth2-proxy-labels.yaml b/contrib/security/PSS/static/restricted/patches/oauth2-proxy-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oauth2-proxy
+  labels:
+    pod-security.kubernetes.io/enforce: restricted