Skip to content

chore: remove PSP and migrate to PSA #2174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sozercan merged 14 commits into from
Aug 1, 2022
Merged

chore: remove PSP and migrate to PSA #2174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
543bf4b
chore: remove PSP
sozercan Jul 15, 2022
17e70bf
handle seccompProfile
sozercan Jul 15, 2022
cac56c7
add PSA
sozercan Jul 15, 2022
154546d
add helm hook
sozercan Jul 16, 2022
b3c2995
Merge branch 'master' into remove-psp
sozercan Jul 16, 2022
85e4871
Merge branch 'master' into remove-psp
sozercan Jul 18, 2022
ac0d824
add securityContext to dummy provider
sozercan Jul 18, 2022
dd6bdb7
Merge branch 'remove-psp' of github.com:sozercan/gatekeeper into remo…
sozercan Jul 18, 2022
bba7330
move helm labels to values
sozercan Jul 18, 2022
e12de55
use range
sozercan Jul 25, 2022
da0cfc6
Merge branch 'master' into remove-psp
sozercan Jul 25, 2022
b6e5994
Merge branch 'master' into remove-psp
sozercan Jul 27, 2022
1190a30
Merge branch 'master' into remove-psp
sozercan Aug 1, 2022
6d7c748
Merge branch 'master' into remove-psp
sozercan Aug 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions cmd/build/helmify/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,8 +73,6 @@ patchesJson6902:
path: /spec/template/spec/containers/0/resources/limits
- op: remove
path: /spec/template/spec/containers/0/resources/requests
- op: remove
path: /spec/template/metadata/annotations/container.seccomp.security.alpha.kubernetes.io~1manager
- op: remove
path: /spec/template/spec/nodeSelector/kubernetes.io~1os
- op: remove
Expand All @@ -91,6 +89,8 @@ patchesJson6902:
path: /spec/template/spec/containers/0/securityContext/runAsNonRoot
- op: remove
path: /spec/template/spec/containers/0/securityContext/runAsUser
- op: remove
path: /spec/template/spec/containers/0/securityContext/seccompProfile
- target:
kind: Deployment
name: gatekeeper-controller-manager
Expand All @@ -99,8 +99,6 @@ patchesJson6902:
path: /spec/template/spec/containers/0/resources/limits
- op: remove
path: /spec/template/spec/containers/0/resources/requests
- op: remove
path: /spec/template/metadata/annotations/container.seccomp.security.alpha.kubernetes.io~1manager
- op: remove
path: /spec/template/spec/nodeSelector/kubernetes.io~1os
- op: remove
Expand All @@ -119,6 +117,8 @@ patchesJson6902:
path: /spec/template/spec/containers/0/securityContext/runAsNonRoot
- op: remove
path: /spec/template/spec/containers/0/securityContext/runAsUser
- op: remove
path: /spec/template/spec/containers/0/securityContext/seccompProfile
- target:
kind: Service
name: webhook-service
Expand Down
2 changes: 1 addition & 1 deletion cmd/build/helmify/kustomize-for-helm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ webhooks:
timeoutSeconds: HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT
failurePolicy: HELMSUBST_VALIDATING_WEBHOOK_CHECK_IGNORE_FAILURE_POLICY
---
apiVersion: policy/v1beta1
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: gatekeeper-controller-manager
Expand Down
6 changes: 1 addition & 5 deletions cmd/build/helmify/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,11 +142,7 @@ func (ks *kindSet) Write() error {
}

if name == "gatekeeper-controller-manager" && kind == "PodDisruptionBudget" {
obj = strings.Replace(obj, "apiVersion: policy/v1beta1", "{{- $v1 := .Capabilities.APIVersions.Has \"policy/v1/PodDisruptionBudget\" -}}\n{{- $v1beta1 := .Capabilities.APIVersions.Has \"policy/v1beta1/PodDisruptionBudget\" -}}\napiVersion: policy/v1{{- if and (not $v1) $v1beta1 -}}beta1{{- end }}", 1)
}

if name == "gatekeeper-admin" && kind == "PodSecurityPolicy" {
obj = "{{- if and .Values.psp.enabled (.Capabilities.APIVersions.Has \"policy/v1beta1/PodSecurityPolicy\") }}\n" + obj + "{{- end }}\n"
obj = strings.Replace(obj, "apiVersion: policy/v1", "{{- $v1 := .Capabilities.APIVersions.Has \"policy/v1/PodDisruptionBudget\" -}}\n{{- $v1beta1 := .Capabilities.APIVersions.Has \"policy/v1beta1/PodDisruptionBudget\" -}}\napiVersion: policy/v1{{- if and (not $v1) $v1beta1 -}}beta1{{- end }}", 1)
}

if name == "gatekeeper-manager-role" && kind == "ClusterRole" {
Expand Down
10 changes: 9 additions & 1 deletion config/rbac/podsecuritypolicy.yaml → ...s/gatekeeper-admin-podsecuritypolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,16 @@
{{- if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: admin
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
labels:
app: '{{ template "gatekeeper.name" . }}'
chart: '{{ template "gatekeeper.name" . }}'
gatekeeper.sh/system: "yes"
heritage: '{{ .Release.Service }}'
release: '{{ .Release.Name }}'
name: gatekeeper-admin
spec:
allowPrivilegeEscalation: false
fsGroup:
Expand All @@ -28,3 +35,4 @@ spec:
- secret
- downwardAPI
- emptyDir
{{- end }}
7 changes: 7 additions & 0 deletions cmd/build/helmify/static/templates/namespace-post-install.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,15 @@ spec:
- {{ . }}
{{- end }}
- admission.gatekeeper.sh/ignore=no-self-managing
{{- range .Values.postInstall.labelNamespace.podSecurity }}
- {{ . }}
{{- end }}
- --overwrite
securityContext:
{{- if .Values.enableRuntimeDefaultSeccompProfile }}
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- toYaml .Values.postInstall.securityContext | nindent 12 }}
---
apiVersion: v1
Expand Down
3 changes: 3 additions & 0 deletions cmd/build/helmify/static/templates/namespace-post-upgrade.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,9 @@ spec:
- {{ . }}
{{- end }}
- admission.gatekeeper.sh/ignore=no-self-managing
{{- range .Values.postInstall.labelNamespace.podSecurity }}
- {{ . }}
{{- end }}
- --overwrite
securityContext:
{{- toYaml .Values.postUpgrade.securityContext | nindent 12 }}
Expand Down
4 changes: 4 additions & 0 deletions cmd/build/helmify/static/templates/upgrade-crds-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,10 @@ spec:
resources:
{{- toYaml .Values.crds.resources | nindent 10 }}
securityContext:
{{- if .Values.enableRuntimeDefaultSeccompProfile }}
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- toYaml .Values.crds.securityContext | nindent 10 }}
affinity:
{{- toYaml .Values.upgradeCRDs.affinity | nindent 8 }}
Expand Down
4 changes: 4 additions & 0 deletions cmd/build/helmify/static/templates/webhook-configs-pre-delete.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ spec:
- mutatingwebhookconfiguration/gatekeeper-mutating-webhook-configuration
{{- end }}
securityContext:
{{- if .Values.enableRuntimeDefaultSeccompProfile }}
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- toYaml .Values.preUninstall.securityContext | nindent 10 }}
---
apiVersion: v1
Expand Down
12 changes: 12 additions & 0 deletions cmd/build/helmify/static/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ postUpgrade:
pullPolicy: IfNotPresent
pullSecrets: []
extraNamespaces: []
podSecurity: ["pod-security.kubernetes.io/audit=restricted",
"pod-security.kubernetes.io/audit-version=latest",
"pod-security.kubernetes.io/warn=restricted",
"pod-security.kubernetes.io/warn-version=latest",
"pod-security.kubernetes.io/enforce=restricted",
"pod-security.kubernetes.io/enforce-version=v1.24"]
Copy link
Copy Markdown
Member

@ritazh ritazh Aug 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we get it via Capabilities.KubeVersion.Version

Copy link
Copy Markdown
Member Author

@sozercan sozercan Aug 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we know we are compatible with 1.24, but we won't know it for future versions. That's why enforce is pinned while audit and warn is latest

securityContext:
allowPrivilegeEscalation: false
capabilities:
Expand All @@ -57,6 +63,12 @@ postInstall:
pullPolicy: IfNotPresent
pullSecrets: []
extraNamespaces: []
podSecurity: ["pod-security.kubernetes.io/audit=restricted",
"pod-security.kubernetes.io/audit-version=latest",
"pod-security.kubernetes.io/warn=restricted",
"pod-security.kubernetes.io/warn-version=latest",
"pod-security.kubernetes.io/enforce=restricted",
"pod-security.kubernetes.io/enforce-version=v1.24"]
probeWebhook:
enabled: true
image:
Expand Down
18 changes: 12 additions & 6 deletions config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@ metadata:
labels:
control-plane: controller-manager
admission.gatekeeper.sh/ignore: no-self-managing
pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/warn-version: latest
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/audit-version: latest
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: v1.24
name: system
---
apiVersion: apps/v1
Expand All @@ -22,8 +28,6 @@ spec:
replicas: 3
template:
metadata:
annotations:
container.seccomp.security.alpha.kubernetes.io/manager: runtime/default
labels:
control-plane: controller-manager
gatekeeper.sh/operation: webhook
Expand Down Expand Up @@ -104,9 +108,11 @@ spec:
runAsGroup: 999
runAsNonRoot: true
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- all
- ALL
terminationGracePeriodSeconds: 60
nodeSelector:
kubernetes.io/os: linux
Expand All @@ -131,8 +137,6 @@ spec:
labels:
control-plane: audit-controller
gatekeeper.sh/operation: audit
annotations:
container.seccomp.security.alpha.kubernetes.io/manager: runtime/default
spec:
automountServiceAccountToken: true
containers:
Expand Down Expand Up @@ -199,10 +203,12 @@ spec:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
- ALL
runAsGroup: 999
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
serviceAccountName: gatekeeper-admin
terminationGracePeriodSeconds: 60
nodeSelector:
Expand Down
2 changes: 1 addition & 1 deletion config/pdb/pdb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
apiVersion: policy/v1beta1
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: controller-manager
Expand Down
1 change: 0 additions & 1 deletion config/rbac/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ resources:
- role.yaml
- role_binding.yaml
- service_account.yaml
- podsecuritypolicy.yaml
# - leader_election_role.yaml
# - leader_election_role_binding.yaml
# Comment the following 3 lines if you want to disable
Expand Down
7 changes: 7 additions & 0 deletions manifest_staging/charts/gatekeeper/templates/namespace-post-install.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,15 @@ spec:
- {{ . }}
{{- end }}
- admission.gatekeeper.sh/ignore=no-self-managing
{{- range .Values.postInstall.labelNamespace.podSecurity }}
- {{ . }}
{{- end }}
- --overwrite
securityContext:
{{- if .Values.enableRuntimeDefaultSeccompProfile }}
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- toYaml .Values.postInstall.securityContext | nindent 12 }}
---
apiVersion: v1
Expand Down
3 changes: 3 additions & 0 deletions manifest_staging/charts/gatekeeper/templates/namespace-post-upgrade.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,9 @@ spec:
- {{ . }}
{{- end }}
- admission.gatekeeper.sh/ignore=no-self-managing
{{- range .Values.postInstall.labelNamespace.podSecurity }}
- {{ . }}
{{- end }}
- --overwrite
securityContext:
{{- toYaml .Values.postUpgrade.securityContext | nindent 12 }}
Expand Down
4 changes: 4 additions & 0 deletions manifest_staging/charts/gatekeeper/templates/upgrade-crds-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,10 @@ spec:
resources:
{{- toYaml .Values.crds.resources | nindent 10 }}
securityContext:
{{- if .Values.enableRuntimeDefaultSeccompProfile }}
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- toYaml .Values.crds.securityContext | nindent 10 }}
affinity:
{{- toYaml .Values.upgradeCRDs.affinity | nindent 8 }}
Expand Down
4 changes: 4 additions & 0 deletions manifest_staging/charts/gatekeeper/templates/webhook-configs-pre-delete.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ spec:
- mutatingwebhookconfiguration/gatekeeper-mutating-webhook-configuration
{{- end }}
securityContext:
{{- if .Values.enableRuntimeDefaultSeccompProfile }}
seccompProfile:
type: RuntimeDefault
{{- end }}
{{- toYaml .Values.preUninstall.securityContext | nindent 10 }}
---
apiVersion: v1
Expand Down
12 changes: 12 additions & 0 deletions manifest_staging/charts/gatekeeper/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ postUpgrade:
pullPolicy: IfNotPresent
pullSecrets: []
extraNamespaces: []
podSecurity: ["pod-security.kubernetes.io/audit=restricted",
"pod-security.kubernetes.io/audit-version=latest",
"pod-security.kubernetes.io/warn=restricted",
"pod-security.kubernetes.io/warn-version=latest",
"pod-security.kubernetes.io/enforce=restricted",
"pod-security.kubernetes.io/enforce-version=v1.24"]
securityContext:
allowPrivilegeEscalation: false
capabilities:
Expand All @@ -57,6 +63,12 @@ postInstall:
pullPolicy: IfNotPresent
pullSecrets: []
extraNamespaces: []
podSecurity: ["pod-security.kubernetes.io/audit=restricted",
"pod-security.kubernetes.io/audit-version=latest",
"pod-security.kubernetes.io/warn=restricted",
"pod-security.kubernetes.io/warn-version=latest",
"pod-security.kubernetes.io/enforce=restricted",
"pod-security.kubernetes.io/enforce-version=v1.24"]
probeWebhook:
enabled: true
image:
Expand Down
Loading