Skip to content

RKE1 pod security admission support#4946

Merged
nwmac merged 5 commits intorancher:masterfrom
mantis-toboggan-md:psa-rke1
Jan 23, 2023
Merged

RKE1 pod security admission support#4946
nwmac merged 5 commits intorancher:masterfrom
mantis-toboggan-md:psa-rke1

Conversation

@mantis-toboggan-md
Copy link
Member

@mantis-toboggan-md mantis-toboggan-md commented Jan 15, 2023

rancher/dashboard#7575

This PR adds PSA support during RKE1 configuration. This is only available for kubernetes versions >=1.23.0. Users creating clusters with versions <1.25 should have the same experience as before, with the addition of a banner informing them that psp support will be disabled in later versions.

Creating a >=1.25.0 cluster

  • no psp options and a banner explaining why
  • psa dropdown with a default of 'privileged'
  • field being set is rancherKubernetesEngineConfig.services.kubeApi.podSecurityConfiguration

Upgrading to >=1.25.0 from a version with PSP support

  • if psp support is enabled, there should be a banner warning to disable it and an error on attempting to create
  • if there are psp resources within the cluster (one or more projects with a psp set) there should be a banner asking the user to delete these psp resources
  • psa dropdown as with creating a >=1.23.0 cluster

rke1 templates

  • users should be able to configure the psa config template field

testing

When I run the ember UI locally websockets do not work correctly: this makes testing cluster provisioning difficult (the ui waits for a message saying the cluster resource is created before creating node pools; this wont work without websockt support). I got around this by building the ember UI and running rancher-in-docker with that custom-built UI replacing the one bundled in the rancher/rancher image using the --mount command. If you don't want to go throught hat ping on slack and I'll give you login details for a testing setup.

codyrancher
codyrancher previously approved these changes Jan 23, 2023
Copy link
Member

@nwmac nwmac left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One change - we want to show the PSA Template drop down if the k8s version is >= 1.23

@nwmac nwmac removed the request for review from catherineluse January 23, 2023 20:08
@nwmac
Copy link
Member

nwmac commented Jan 23, 2023

@codyrancher Can you review my changes - I pushed a commit so that PSA support is enabled for >= 1.23 (which is when it is introduced). PSP removed in 1.25 and code updated as PSP support overlaps with PSA support now.

@nwmac nwmac requested a review from codyrancher January 23, 2023 20:25
@nwmac nwmac merged commit 9ba86b9 into rancher:master Jan 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants