Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of Disable PodSecurityPolicy when global.enablePodSecurityPolicies set to false into release/0.49.x #1745

Merged
merged 2 commits into from
Nov 21, 2022
Merged

Backport of Disable PodSecurityPolicy when global.enablePodSecurityPolicies set to false into release/0.49.x #1745

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5dbf372
no-op commit due to failed cherry-picking
Nov 18, 2022
97f1cc6
Disable PodSecurityPolicy when global.enablePodSecurityPolicies set t…
tunguyen9889 Nov 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/consul/templates/gossip-encryption-autogenerate-podsecuritypolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if .Values.global.gossipEncryption.autoGenerate }}
{{- if and .Values.global.gossipEncryption.autoGenerate .Values.global.enablePodSecurityPolicies }}
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
Expand Down
2 changes: 1 addition & 1 deletion charts/consul/templates/partition-init-podsecuritypolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{{- $serverEnabled := (or (and (ne (.Values.server.enabled | toString) "-") .Values.server.enabled) (and (eq (.Values.server.enabled | toString) "-") .Values.global.enabled)) -}}
{{- if (and .Values.global.adminPartitions.enabled (not $serverEnabled)) }}
{{- if (and .Values.global.adminPartitions.enabled .Values.global.enablePodSecurityPolicies (not $serverEnabled)) }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
Expand Down
21 changes: 20 additions & 1 deletion charts/consul/test/unit/gossip-encryption-autogenerate-podsecuritypolicy.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,30 @@ load _helpers
.
}

@test "gossipEncryptionAutogenerate/PodSecurityPolicy: enabled with global.gossipEncryption.autoGenerate=true" {
@test "gossipEncryptionAutogenerate/PodSecurityPolicy: disabled with global.gossipEncryption.autoGenerate=true and global.enablePodSecurityPolicies=false" {
cd `chart_dir`
assert_empty helm template \
-s templates/gossip-encryption-autogenerate-podsecuritypolicy.yaml \
--set 'global.gossipEncryption.autoGenerate=true' \
--set 'global.enablePodSecurityPolicies=false' \
.
}

@test "gossipEncryptionAutogenerate/PodSecurityPolicy: disabled with global.gossipEncryption.autoGenerate=false and global.enablePodSecurityPolicies=true" {
cd `chart_dir`
assert_empty helm template \
-s templates/gossip-encryption-autogenerate-podsecuritypolicy.yaml \
--set 'global.gossipEncryption.autoGenerate=false' \
--set 'global.enablePodSecurityPolicies=true' \
.
}

@test "gossipEncryptionAutogenerate/PodSecurityPolicy: enabled with global.gossipEncryption.autoGenerate=true and global.enablePodSecurityPolicies=true" {
cd `chart_dir`
local actual=$(helm template \
-s templates/gossip-encryption-autogenerate-podsecuritypolicy.yaml \
--set 'global.gossipEncryption.autoGenerate=true' \
--set 'global.enablePodSecurityPolicies=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
Expand Down
60 changes: 56 additions & 4 deletions charts/consul/test/unit/partition-init-podsecuritypolicy.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,40 +9,92 @@ load _helpers
.
}

@test "partitionInit/PodSecurityPolicy: enabled with global.adminPartitions.enabled=true and servers = false" {
@test "partitionInit/PodSecurityPolicy: enabled with global.adminPartitions.enabled=true and global.enablePodSecurityPolicies=true and server.enabled=false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=true' \
--set 'server.enabled=false' \
. | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and servers = true" {
@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and global.enablePodSecurityPolicies=false and server.enabled=false" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=false' \
--set 'server.enabled=false' \
.
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and global.enablePodSecurityPolicies=true and servers = true" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=true' \
--set 'server.enabled=true' \
.
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and global.enablePodSecurityPolicies=false and servers = true" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=false' \
--set 'server.enabled=true' \
.
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and global.enabled = true" {
@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and global.enablePodSecurityPolicies=true and global.enabled = true" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=true' \
--set 'global.enabled=true' \
.
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=false" {
@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=true and global.enablePodSecurityPolicies=false and global.enabled = true" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=false' \
--set 'global.enabled=true' \
.
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=false and global.enablePodSecurityPolicies=true" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=true' \
--set 'server.enabled=true' \
.
}

@test "partitionInit/PodSecurityPolicy: disabled with global.adminPartitions.enabled=false and global.enablePodSecurityPolicies=false" {
cd `chart_dir`
assert_empty helm template \
-s templates/partition-init-podsecuritypolicy.yaml \
--set 'global.adminPartitions.enabled=true' \
--set 'global.enableConsulNamespaces=true' \
--set 'global.enablePodSecurityPolicies=false' \
--set 'server.enabled=true' \
.
}