fix: disable psp as default (#3179)

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
open-policy-agent · Dec 5, 2023 · c0e231a · c0e231a
1 parent 99cefba
commit c0e231a
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/cmd/build/helmify/static/README.md b/cmd/build/helmify/static/README.md
@@ -120,7 +120,7 @@ information._
 | preUninstall.nodeSelector                                  | The node selector to use for pod scheduling in preUninstall hook jobs                                                                                                                                                                                                                          | `kubernetes.io/os: linux`                                                                                                                                             |
 | preUninstall.resources                                     | The resource request/limits for the container image in preUninstall hook jobs                                                                                                                                                                                                                  | `{}`                                                                                                                                                                  |
 | preUninstall.securityContext                               | Security context applied on the container                                                                                                                                                                                                                                                      | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }`    |
-| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `true`                                                                                                                                                                |
+| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `false`                                                                                                                                                                |
 | upgradeCRDs.enabled                                        | Upgrade CRDs using pre-install/pre-upgrade hooks                                                                                                                                                                                                                                               | `true`                                                                                                                                                                |
 | upgradeCRDs.extraRules                                     | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole                                                                                                                                                                                                                                  | `[]`                                                                                                                                                                  |
 | upgradeCRDs.priorityClassName                              | Priority class name for gatekeeper-update-crds-hook Job                                                                                                                                                                                                                                        | ``                                                                                                                                                                    |

diff --git a/cmd/build/helmify/static/values.yaml b/cmd/build/helmify/static/values.yaml
@@ -264,7 +264,7 @@ pdb:
 service: {}
 disabledBuiltins: ["{http.send}"]
 psp:
-  enabled: true
+  enabled: false
 upgradeCRDs:
   enabled: true
   extraRules: []

diff --git a/manifest_staging/charts/gatekeeper/README.md b/manifest_staging/charts/gatekeeper/README.md
@@ -120,7 +120,7 @@ information._
 | preUninstall.nodeSelector                                  | The node selector to use for pod scheduling in preUninstall hook jobs                                                                                                                                                                                                                          | `kubernetes.io/os: linux`                                                                                                                                             |
 | preUninstall.resources                                     | The resource request/limits for the container image in preUninstall hook jobs                                                                                                                                                                                                                  | `{}`                                                                                                                                                                  |
 | preUninstall.securityContext                               | Security context applied on the container                                                                                                                                                                                                                                                      | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }`    |
-| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `true`                                                                                                                                                                |
+| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `false`                                                                                                                                                                |
 | upgradeCRDs.enabled                                        | Upgrade CRDs using pre-install/pre-upgrade hooks                                                                                                                                                                                                                                               | `true`                                                                                                                                                                |
 | upgradeCRDs.extraRules                                     | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole                                                                                                                                                                                                                                  | `[]`                                                                                                                                                                  |
 | upgradeCRDs.priorityClassName                              | Priority class name for gatekeeper-update-crds-hook Job                                                                                                                                                                                                                                        | ``                                                                                                                                                                    |

diff --git a/manifest_staging/charts/gatekeeper/values.yaml b/manifest_staging/charts/gatekeeper/values.yaml
@@ -264,7 +264,7 @@ pdb:
 service: {}
 disabledBuiltins: ["{http.send}"]
 psp:
-  enabled: true
+  enabled: false
 upgradeCRDs:
   enabled: true
   extraRules: []