backport PSS helm flag

giantswarm · Apr 22, 2024 · 42e5606 · 42e5606
1 parent 5453531
commit 42e5606
Show file tree

Hide file tree

Showing 6 changed files with 31 additions and 0 deletions.
diff --git a/.nancy-ignore b/.nancy-ignore
@@ -21,3 +21,9 @@ CVE-2023-3978
 
 # golang/google.golang.org/grpc@v1.52.0
 CVE-2023-32731 until=2023-08-30
+
+CVE-2024-24786
+CVE-2023-39325
+CVE-2023-48795
+CVE-2023-47108
+CVE-2023-47090
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add global.podSecurityStandards.enforced value for PSS migration.
+
 ## [5.8.0-patch1] - 2023-09-26
 
 ### Added

diff --git a/helm/cluster-operator/templates/psp.yaml b/helm/cluster-operator/templates/psp.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.global.podSecurityStandards.enforced }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
@@ -31,3 +32,4 @@ spec:
   hostNetwork: false
   hostIPC: false
   hostPID: false
+{{- end }}
diff --git a/helm/cluster-operator/templates/rbac.yaml b/helm/cluster-operator/templates/rbac.yaml
@@ -154,6 +154,7 @@ roleRef:
   name: {{ include "resource.default.name"  . }}
   apiGroup: rbac.authorization.k8s.io
 ---
+{{- if not .Values.global.podSecurityStandards.enforced }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -184,3 +185,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "resource.psp.name" . }}
   apiGroup: rbac.authorization.k8s.io
+{{- end }}
diff --git a/helm/cluster-operator/values.schema.json b/helm/cluster-operator/values.schema.json
@@ -192,6 +192,19 @@
                     }
                 }
             }
+        },
+        "global": {
+            "type": "object",
+            "properties": {
+                "podSecurityStandards": {
+                    "type": "object",
+                    "properties": {
+                        "enforced": {
+                            "type": "boolean"
+                        }
+                    }
+                }
+            }
         }
     }
 }
diff --git a/helm/cluster-operator/values.yaml b/helm/cluster-operator/values.yaml
@@ -76,3 +76,7 @@ securityContext:
   capabilities:
     drop:
     - ALL
+
+global:
+  podSecurityStandards:
+    enforced: false