-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Document helm chart PodSecurityPolicy deprecation and PodSecurityAdmission alternative #7626
Conversation
Codecov Report
@@ Coverage Diff @@
## master #7626 +/- ##
==========================================
- Coverage 42.16% 42.16% -0.01%
==========================================
Files 217 217
Lines 12092 12092
Branches 179 179
==========================================
- Hits 5099 5098 -1
- Misses 6708 6709 +1
Partials 285 285 |
The current way does not block using Kubernetes 1.25+ since one just has to disable PSP. Moreover, it is disabled by default. So it depends how much time we want to support Kubernetes 1.24-, but I would not merge this now since we don't really have a reason to actually break deployments still relying on PSP. It can be present for a long time, maybe with a comment stating it is not compatible with 1.25+. Regarding it's successor, it goes against the Helm philosophy, but indeed we could add one, disabled by default, clearly documenting in the values the limitations. Usually, the |
Good point, you're right we should not break older deployments still wanting /retitle Document helm chart PodSecurityPolicy deprecation and PodSecurityAdmission alternative |
@jmhbnz: Re-titling can only be requested by trusted users, like repository collaborators. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Thanks! |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: desaintmartin, jmhbnz The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/retest |
@desaintmartin It looks like the e2e tests ran into issues but Should I raise an issue for these tests it looks like they are taking a long time to run and flaky? Let me know if there is anything you need me to do at my end to retrigger these. |
Indeed! |
New changes are detected. LGTM label has been removed. |
Thank you for tackling this! |
@shu-mutou I don't have permissions to re-run tests, unfortunately! |
Add documentation for podsecurityadmission at namespace level as an alternative. Signed-off-by: James Blair <mail@jamesblair.net>
Hey @shu-mutou I have tried rebasing a few times to retrigger tests but the e2e test keeps timing out. Are you able to merge this as is? |
End-to-end tests are flaky at the moment. I will merge manually. |
Pod security policy has been removed from kubernetes 1.25 onwards. The successor pod security admission is not fully supported in helm as it involved labeling the release namespace which helm does not support. Refer helm/helm#3503.
Additionally since pod security admission is managed at the namespace level we probably shouldn't touch it unless we can be certain we are the sole namespace tenant.
Perhaps we should just be updating documentation to outline how users of the chart can label their namespace post chart deployment to add a pod security policy label?
Starting this pull request as a draft to generate some discussion on next steps and hopefully get a consensus.
Fixes: #7608