(psa) label namespace PSA:restricted, and make workload compliant
#14
Conversation
openshift-merge-robot
added
the
needs-rebase
openshift-merge-robot
removed
the
needs-rebase
This PR applies the `restricted` security level [defined by the Pod Security Admission Controller](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/). It also modifies the deployments to add the required securityContext for the pods deployed to be admitted at the `restricted` level.
There was a problem hiding this comment.
Overall this looks good to me, just a small comment on it. The structure you've gone with here reflects our currently set precedence. We'll need an approve as well as some overrides from @timflannagan when this is ready.
/lgtm
| metadata: | ||
| labels: | ||
| control-plane: controller-manager | ||
| openshift.io/scc: "anyuid" |
There was a problem hiding this comment.
I'd like to see a comment describing why we're setting this label to this value with a link to the documentation. Do you think that would be too invasive?
| pod-security.kubernetes.io/enforce: restricted | ||
| pod-security.kubernetes.io/enforce-version: v1.24 |
There was a problem hiding this comment.
Same from above applied to these lines.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: anik120, tylerslaton The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/hold Till we make necessary changes to rukpak's workloads to make them compatible for the restricted profile. |
openshift-ci
bot
added
the
do-not-merge/hold
|
@anik120: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
openshift-merge-robot
added
the
needs-rebase
|
@anik120: PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/close |
|
@timflannagan: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
4 participants
This PR applies the
restrictedsecurity level defined by the Pod SecurityAdmission Controller. It also modifies
the deployments to add the required securityContext for the pods deployed to be
admitted at the
restrictedlevel.