OCPBUGS-4758: Unenforce PSA Restrictions #491
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: awgreene The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
bparees
removed
the
approved
|
lgtm |
manifests/01_namespace.yaml
Outdated
| labels: | ||
| openshift.io/cluster-monitoring: "true" | ||
| pod-security.kubernetes.io/enforce: restricted | ||
| pod-security.kubernetes.io/enforce: privileged |
There was a problem hiding this comment.
Have we checked to see if this could be baseline instead of privileged and still support legacy catalog sources?
| pod-security.kubernetes.io/enforce: privileged | |
| pod-security.kubernetes.io/enforce: baseline |
There was a problem hiding this comment.
Also, let's add the following?
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
|
/retest |
|
+1 to all of Joe's comments otherwise lgtm |
|
/retest |
awgreene
force-pushed
the
unenforce-psa-restrictions
branch
from
329c91a to
e196523
Compare
openshift-ci
bot
added
the
approved
|
/retest |
13 similar comments
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/test ci/prow/e2e-gcp-serial |
|
@awgreene: The specified target(s) for
The following commands are available to trigger optional jobs:
Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/retest |
awgreene
changed the title
|
@awgreene: This pull request references Jira Issue OCPBUGS-3881, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
jira/invalid-bug
|
/retest |
2 similar comments
|
/retest |
|
/retest |
|
@awgreene: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/test e2e-gcp-serial |
awgreene
changed the title
|
@awgreene: This pull request references Jira Issue OCPBUGS-4758, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/jira refresh |
|
@awgreene: This pull request references Jira Issue OCPBUGS-4758, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@awgreene: This pull request references Jira Issue OCPBUGS-4758, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/override e2e-gcp-serial |
|
@awgreene: /override requires failed status contexts, check run or a prowjob name to operate on.
Only the following failed contexts/checkruns were expected:
If you are trying to override a checkrun that has a space in it, you must put a double quote on the context. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
The e2e-gcp-serial tests failed due to a slight disruption of services, which has been seen in:
/override ci/prow/e2e-gcp-serial |
|
@awgreene: Overrode contexts on behalf of awgreene: ci/prow/e2e-gcp-serial DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@awgreene: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-4758 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherry-pick release-4.12 |
|
@awgreene: new pull request created: #494 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
7 participants
OpenShift v4.12 had previously enforced PSA restrictions by defaults in and namespace prefixed with
openshift-. This change has been delayed until OpenShift v4.13 and users should be allowed to run catalogs without restricted permissions in the openshift-marketplace namespace.