diff --git a/CHANGELOG.md b/CHANGELOG.md index 3db868232..439d8cd6d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added - Add team label in resources. +- Add `global.podSecurityStandards.enforced` value for PSS migration. ## [5.10.0] - 2023-10-17 diff --git a/helm/cluster-operator/templates/psp.yaml b/helm/cluster-operator/templates/psp.yaml index b8ba19cab..cc2e7669c 100644 --- a/helm/cluster-operator/templates/psp.yaml +++ b/helm/cluster-operator/templates/psp.yaml @@ -1,3 +1,4 @@ +{{- if not .Values.global.podSecurityStandards.enforced }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: @@ -31,3 +32,4 @@ spec: hostNetwork: false hostIPC: false hostPID: false +{{- end }} diff --git a/helm/cluster-operator/templates/rbac.yaml b/helm/cluster-operator/templates/rbac.yaml index 81dc95586..35e513417 100644 --- a/helm/cluster-operator/templates/rbac.yaml +++ b/helm/cluster-operator/templates/rbac.yaml @@ -154,6 +154,7 @@ roleRef: name: {{ include "resource.default.name" . }} apiGroup: rbac.authorization.k8s.io --- +{{- if not .Values.global.podSecurityStandards.enforced }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -184,3 +185,4 @@ roleRef: kind: ClusterRole name: {{ include "resource.psp.name" . }} apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/helm/cluster-operator/values.schema.json b/helm/cluster-operator/values.schema.json index 92683bf72..ed8dddbb9 100644 --- a/helm/cluster-operator/values.schema.json +++ b/helm/cluster-operator/values.schema.json @@ -192,6 +192,19 @@ } } } + }, + "global": { + "type": "object", + "properties": { + "podSecurityStandards": { + "type": "object", + "properties": { + "enforced": { + "type": "boolean" + } + } + } + } } } } diff --git a/helm/cluster-operator/values.yaml b/helm/cluster-operator/values.yaml index a5fea5d08..9b586dd57 100644 --- a/helm/cluster-operator/values.yaml +++ b/helm/cluster-operator/values.yaml @@ -76,3 +76,7 @@ securityContext: capabilities: drop: - ALL + +global: + podSecurityStandards: + enforced: false