Add PSP toggle for k8s 1.25 (#1189)

giantswarm · Nov 9, 2023 · fdfcddd · fdfcddd
1 parent b27e12d
commit fdfcddd
Show file tree

Hide file tree

Showing 6 changed files with 225 additions and 207 deletions.
diff --git a/.nancy-ignore b/.nancy-ignore
@@ -26,6 +26,7 @@ CVE-2023-25809 until=2024-01-31
 
 # pkg:golang/golang.org/x/[email protected]
 CVE-2023-3978 until=2024-01-31
+CVE-2023-39325 until=2023-11-30
 
 # pkg:golang/helm.sh/helm/[email protected]
 CVE-2023-25165 until=2024-01-31

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 ## [Unreleased]
 
+### Changed
+
+- Add a switch for PSP CR installation.
+
 ## [6.8.1] - 2023-09-14
 
 ### Fixed

diff --git a/helm/app-operator/templates/psp.yaml b/helm/app-operator/templates/psp.yaml
@@ -1,4 +1,4 @@
-{{- if .Capabilities.APIVersions.Has "policy/v1beta1" }}
+{{- if not .Values.podSecurityStandards.enforced }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/helm/app-operator/templates/rbac.yaml b/helm/app-operator/templates/rbac.yaml
@@ -224,6 +224,7 @@ roleRef:
   name: {{ include "resource.default.name" . }}-catalog
   apiGroup: rbac.authorization.k8s.io
 ---
+{{- if not .Values.podSecurityStandards.enforced }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -254,3 +255,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "resource.psp.name" . }}
   apiGroup: rbac.authorization.k8s.io
+{{- end }}