diff --git a/Makefile b/Makefile index 0ea882a581..afa21ecd8d 100644 --- a/Makefile +++ b/Makefile @@ -161,6 +161,16 @@ vendor: .PHONY: manifests manifests: ## Generate manifests OLM_VERSION=$(OLM_VERSION) ./scripts/generate_crds_manifests.sh + $(MAKE) update-k8s-manifests + +# Minor Kubernetes version to build against derived from the client-go dependency version +KUBE_MINOR ?= $(shell go list -m k8s.io/client-go | cut -d" " -f2 | sed 's/^v0\.\([[:digit:]]\{1,\}\)\.[[:digit:]]\{1,\}$$/1.\1/') + +.PHONY: update-k8s-manifests # HELP Update pod security versions in manifests with Kubernetes version +update-k8s-manifests: + find manifests microshift-manifests -type f -name '*.yaml' -exec \ + sed -i.bak -E 's/(pod-security.kubernetes.io\/[a-zA-Z-]+-version:).*/\1 "v$(KUBE_MINOR)"/g' {} +; + find manifests microshift-manifests -type f -name '*.yaml.bak' -delete .PHONY: generate-manifests generate-manifests: OLM_VERSION=0.0.1-snapshot diff --git a/manifests/0000_50_olm_00-namespace.yaml b/manifests/0000_50_olm_00-namespace.yaml index 5680a258d3..1a5dfa6d5b 100644 --- a/manifests/0000_50_olm_00-namespace.yaml +++ b/manifests/0000_50_olm_00-namespace.yaml @@ -4,7 +4,7 @@ metadata: name: openshift-operator-lifecycle-manager labels: pod-security.kubernetes.io/enforce: restricted - pod-security.kubernetes.io/enforce-version: "v1.24" + pod-security.kubernetes.io/enforce-version: "v1.31" openshift.io/scc: "" openshift.io/cluster-monitoring: "true" annotations: @@ -21,7 +21,7 @@ metadata: name: openshift-operators labels: pod-security.kubernetes.io/enforce: privileged - pod-security.kubernetes.io/enforce-version: "v1.24" + pod-security.kubernetes.io/enforce-version: "v1.31" openshift.io/scc: "" annotations: openshift.io/node-selector: "" diff --git a/microshift-manifests/0000_50_olm_00-namespace.yaml b/microshift-manifests/0000_50_olm_00-namespace.yaml index 5680a258d3..1a5dfa6d5b 100644 --- a/microshift-manifests/0000_50_olm_00-namespace.yaml +++ b/microshift-manifests/0000_50_olm_00-namespace.yaml @@ -4,7 +4,7 @@ metadata: name: openshift-operator-lifecycle-manager labels: pod-security.kubernetes.io/enforce: restricted - pod-security.kubernetes.io/enforce-version: "v1.24" + pod-security.kubernetes.io/enforce-version: "v1.31" openshift.io/scc: "" openshift.io/cluster-monitoring: "true" annotations: @@ -21,7 +21,7 @@ metadata: name: openshift-operators labels: pod-security.kubernetes.io/enforce: privileged - pod-security.kubernetes.io/enforce-version: "v1.24" + pod-security.kubernetes.io/enforce-version: "v1.31" openshift.io/scc: "" annotations: openshift.io/node-selector: "" diff --git a/staging/operator-lifecycle-manager/Makefile b/staging/operator-lifecycle-manager/Makefile index d90bd37006..036cf4f7d6 100644 --- a/staging/operator-lifecycle-manager/Makefile +++ b/staging/operator-lifecycle-manager/Makefile @@ -263,7 +263,14 @@ e2e-local: e2e-build kind-create deploy e2e #SECTION Code Generation .PHONY: gen-all #HELP Update OLM API, generate code and mocks -gen-all: manifests codegen mockgen +gen-all: manifests codegen update-k8s-values mockgen + +.PHONY: update-k8s-values #HELP Update Helm Chart values with Kubernetes version +update-k8s-values: + sed -i.bak -E 's/^( *enforceVersion:).*/\1 "v$(KUBE_MINOR)"/' deploy/chart/values.yaml + sed -i.bak -E 's/^( *auditVersion:).*/\1 "v$(KUBE_MINOR)"/' deploy/chart/values.yaml + sed -i.bak -E 's/^( *warnVersion:).*/\1 "v$(KUBE_MINOR)"/' deploy/chart/values.yaml + rm deploy/chart/values.yaml.bak .PHONY: manifests manifests: vendor #HELP Copy OLM API CRD manifests to deploy/chart/crds @@ -300,8 +307,12 @@ verify-mockgen: mockgen #HELP Check mocks are up to date verify-manifests: manifests #HELP Check CRD manifests are up to date $(MAKE) diff +.PHONY: verify-update-k8s-values +verify-update-k8s-values: update-k8s-values #HELP Check if Helm Chart values are updated with k8s version + $(MAKE) diff + .PHONY: verify -verify: vendor verify-codegen verify-mockgen verify-manifests #HELP Run all verification checks +verify: vendor verify-codegen verify-mockgen verify-manifests verify-update-k8s-values #HELP Run all verification checks $(MAKE) diff #SECTION Release diff --git a/staging/operator-lifecycle-manager/deploy/chart/values.yaml b/staging/operator-lifecycle-manager/deploy/chart/values.yaml index ffb5891842..5b1983c4b6 100644 --- a/staging/operator-lifecycle-manager/deploy/chart/values.yaml +++ b/staging/operator-lifecycle-manager/deploy/chart/values.yaml @@ -3,17 +3,17 @@ namespace: operator-lifecycle-manager # see https://kubernetes.io/docs/concepts/security/pod-security-admission/ for more details namespace_psa: enforceLevel: baseline - enforceVersion: latest + enforceVersion: "v1.31" auditLevel: restricted - auditVersion: latest + auditVersion: "v1.31" warnLevel: restricted - warnVersion: latest + warnVersion: "v1.31" catalog_namespace: operator-lifecycle-manager operator_namespace: operators # see https://kubernetes.io/docs/concepts/security/pod-security-admission/ for more details operator_namespace_psa: enforceLevel: baseline - enforceVersion: latest + enforceVersion: "v1.31" minKubeVersion: 1.11.0 writeStatusName: '""' imagestream: false