Add labels for pod security standards #1093
Conversation
This commit adds the restricted pod security standard labels to the operators namespace. Since the handler requires the privileged PSS label the operator will apply this label to the namespace where the handler will be installed. Signed-off-by: Christoph Stäbler <cstabler@redhat.com>
kubevirt-bot
added
release-note
|
Skipping CI for Draft Pull Request. |
|
/test all |
kubevirt-bot
removed
the
do-not-merge/work-in-progress
|
/assign @cybertron |
|
@creydr: GitHub didn't allow me to assign the following users: cybertron. Note that only nmstate members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cc @cybertron |
|
@creydr: GitHub didn't allow me to request PR reviews from the following users: cybertron. Note that only nmstate members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: qinqon The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubevirt-bot
added
the
approved
|
@creydr: The following test failed, say
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/retest-required |
Is this a BUG FIX or a FEATURE ?:
/kind enhancement
What this PR does / why we need it:
This PR adds the pod security standard (PSS) labels to the namespace(s).
As the operator itself does not require any privileged permissions, by default the operator namespace will have the restricted PSS. When the handler gets installed, this will "update" to the privileged PSS.
In addition the security context of the operator deployment was adjusted to not run the container as root (I didn't see a need for being root in the operator container) and changed the uid in the dockerfile to
1000.Special notes for your reviewer:
Release note: