Skip to content

Commit a0dab22

Browse files
awgreeneawgreene
authored
Default to legacy PSA settings (#2906)
* Bump operator-framework/api v0.17.3 Signed-off-by: Alexander Greene <[email protected]> * Default to legacy PSA settings Problem: OLM recently introduced a few changes to default to running its workloads in a restricted mode. As a part of these changes, catalogSources built with earlier versions of OPM will not run as expected unless the catalogSource yaml is configured to run in a legacy version. Unfortunately, these legacy catalogs cannot be ran in restricted namespaces, which includes the `olm` namespace which is used to define global catalogSources. Solution: Provide users ample time to convert to the new restricted fromat by defaulting to legacy restrictions and reclassify the `olm` namespace as a baseline privilege namespace. Signed-off-by: Alexander Greene <[email protected]> * Update chart values and generate manifests Signed-off-by: Alexander Greene <[email protected]> Signed-off-by: Alexander Greene <[email protected]>
1 parent 7eccf53 commit a0dab22

File tree

223 files changed

+7864
-2150
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

223 files changed

+7864
-2150
lines changed

‎deploy/chart/crds/0000_50_olm_00-catalogsources.crd.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: catalogsources.operators.coreos.com
88
spec:
@@ -80,9 +80,9 @@ spec:
8080
description: If specified, indicates the pod's priority. If not specified, the pod priority will be default or zero if there is no default.
8181
type: string
8282
securityContextConfig:
83-
description: 'SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource''s pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission(PSA) controller''s `restricted` mode, or doesn''t set these values at all, in which case the pod can only be run in PSA `baseline` or `privileged` namespaces. By default, SecurityContextConfig is set to `restricted`. If the value is unspecified, the default value of `restricted` is used. Specifying any other value will result in a validation error. When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'''
83+
description: "SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. \n In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. \n More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'"
8484
type: string
85-
default: restricted
85+
default: legacy
8686
enum:
8787
- legacy
8888
- restricted
@@ -152,7 +152,7 @@ spec:
152152
description: Represents the state of a CatalogSource. Note that Message and Reason represent the original status information, which may be migrated to be conditions based in the future. Any new features introduced will use conditions.
153153
type: array
154154
items:
155-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
155+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
156156
type: object
157157
required:
158158
- lastTransitionTime

‎deploy/chart/crds/0000_50_olm_00-clusterserviceversions.crd.yaml

+25-10
Large diffs are not rendered by default.

‎deploy/chart/crds/0000_50_olm_00-installplans.crd.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: installplans.operators.coreos.com
88
spec:

‎deploy/chart/crds/0000_50_olm_00-olmconfigs.crd.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: olmconfigs.operators.coreos.com
88
spec:
@@ -50,7 +50,7 @@ spec:
5050
conditions:
5151
type: array
5252
items:
53-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
53+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
5454
type: object
5555
required:
5656
- lastTransitionTime

‎deploy/chart/crds/0000_50_olm_00-operatorconditions.crd.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: operatorconditions.operators.coreos.com
88
spec:
@@ -45,7 +45,7 @@ spec:
4545
overrides:
4646
type: array
4747
items:
48-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
48+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
4949
type: object
5050
required:
5151
- message
@@ -95,7 +95,7 @@ spec:
9595
conditions:
9696
type: array
9797
items:
98-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
98+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
9999
type: object
100100
required:
101101
- lastTransitionTime
@@ -162,7 +162,7 @@ spec:
162162
conditions:
163163
type: array
164164
items:
165-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
165+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
166166
type: object
167167
required:
168168
- lastTransitionTime
@@ -209,7 +209,7 @@ spec:
209209
overrides:
210210
type: array
211211
items:
212-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
212+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
213213
type: object
214214
required:
215215
- message
@@ -259,7 +259,7 @@ spec:
259259
conditions:
260260
type: array
261261
items:
262-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
262+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
263263
type: object
264264
required:
265265
- lastTransitionTime

‎deploy/chart/crds/0000_50_olm_00-operatorgroups.crd.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: operatorgroups.operators.coreos.com
88
spec:
@@ -99,7 +99,7 @@ spec:
9999
description: Conditions is an array of the OperatorGroup's conditions.
100100
type: array
101101
items:
102-
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
102+
description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
103103
type: object
104104
required:
105105
- lastTransitionTime

‎deploy/chart/crds/0000_50_olm_00-operators.crd.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: operators.operators.coreos.com
88
spec:

‎deploy/chart/crds/0000_50_olm_00-subscriptions.crd.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.8.0
5+
controller-gen.kubebuilder.io/version: v0.9.0
66
creationTimestamp: null
77
name: subscriptions.operators.coreos.com
88
spec:

‎deploy/chart/templates/0000_50_olm_00-namespace.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ metadata:
66
{{- if .Values.namespace_psa }}
77
pod-security.kubernetes.io/enforce: {{ .Values.namespace_psa.enforceLevel }}
88
pod-security.kubernetes.io/enforce-version: {{ .Values.namespace_psa.enforceVersion }}
9+
pod-security.kubernetes.io/audit: {{ .Values.namespace_psa.auditLevel }}
10+
pod-security.kubernetes.io/audit-version: {{ .Values.namespace_psa.auditVersion }}
11+
pod-security.kubernetes.io/warn: {{ .Values.namespace_psa.warnLevel }}
12+
pod-security.kubernetes.io/warn-version: {{ .Values.namespace_psa.warnVersion }}
913
{{- end }}
1014

1115
---
@@ -17,4 +21,8 @@ metadata:
1721
{{- if .Values.operator_namespace_psa }}
1822
pod-security.kubernetes.io/enforce: {{ .Values.operator_namespace_psa.enforceLevel }}
1923
pod-security.kubernetes.io/enforce-version: {{ .Values.operator_namespace_psa.enforceVersion }}
24+
pod-security.kubernetes.io/audit: {{ .Values.namespace_psa.auditLevel }}
25+
pod-security.kubernetes.io/audit-version: {{ .Values.namespace_psa.auditVersion }}
26+
pod-security.kubernetes.io/warn: {{ .Values.namespace_psa.warnLevel }}
27+
pod-security.kubernetes.io/warn-version: {{ .Values.namespace_psa.warnVersion }}
2028
{{- end }}

‎deploy/chart/values.yaml

+5-1
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,12 @@ rbacApiVersion: rbac.authorization.k8s.io
22
namespace: operator-lifecycle-manager
33
# see https://kubernetes.io/docs/concepts/security/pod-security-admission/ for more details
44
namespace_psa:
5-
enforceLevel: restricted
5+
enforceLevel: baseline
66
enforceVersion: latest
7+
auditLevel: restricted
8+
auditVersion: latest
9+
warnLevel: restricted
10+
warnVersion: latest
711
catalog_namespace: operator-lifecycle-manager
812
operator_namespace: operators
913
# see https://kubernetes.io/docs/concepts/security/pod-security-admission/ for more details

0 commit comments

Comments
 (0)