fix(crds-upgrade): add psp for crds-upgrade-hook
Adds a PSP for the crds-upgrade-hook. This change allows OSM to be
installed on a PSP enabled cluster.
+{{- if and (not (.Capabilities.APIVersions.Has "security.openshift.io/v1")) .Values.OpenServiceMesh.pspEnabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+ name: {{ .Release.Name }}-upgrade-crds-psp
+ annotations:
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
+ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+ seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
+ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+ helm.sh/hook-weight: "-1"
+ helm.sh/hook: pre-install,pre-upgrade
+ helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
+spec:
+ privileged: false
+ # Required to prevent escalations to root.
+ allowPrivilegeEscalation: false
+ # This is redundant with non-root + disallow privilege escalation,
+ # but we can provide it for defense in depth.
+ requiredDropCapabilities:
+ - ALL
+ volumes:
+ - 'configMap'
+ - 'emptyDir'
+ - 'projected'
+ - 'secret'
+ - 'downwardAPI'
+ # Assume that persistentVolumes set up by the cluster admin are safe to use.
+ - 'persistentVolumeClaim'
+ hostNetwork: false
+ hostIPC: false
+ hostPID: false
+ runAsUser:
+ # Require the container to run without root privileges.
+ rule: 'MustRunAsNonRoot'
+ seLinux:
+ # This policy assumes the nodes are using AppArmor rather than SELinux.
+ rule: 'RunAsAny'
+ supplementalGroups:
+ rule: 'MustRunAs'
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ fsGroup:
+ rule: 'MustRunAs'
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ readOnlyRootFilesystem: false
+{{- end }}
+
+---
+
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
@@ -12,7 +67,15 @@ rules:
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
+ {{- if .Values.OpenServiceMesh.pspEnabled }}
+ - apiGroups: ["extensions"]
+ resourceNames: ["{{ .Release.Name }}-upgrade-crds-psp"]
+ resources: ["podsecuritypolicies"]
+ verbs: ["use"]
+ {{- end }}
+
---
+
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
@@ -31,7 +94,9 @@ roleRef:
kind: ClusterRole
name: {{ .Release.Name }}-upgrade-crds
apiGroup: rbac.authorization.k8s.io
+
---
+
apiVersion: v1
kind: ServiceAccount
metadata:
@@ -42,7 +107,9 @@ metadata:
annotations:
helm.sh/hook: pre-install,pre-upgrade
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
+
---
+
apiVersion: batch/v1
kind: Job
metadata:
