Add PSP toggle (#38)

giantswarm · Jan 22, 2024 · 5bf36e5 · 5bf36e5
1 parent 2aac5e0
commit 5bf36e5
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Configure `gsoci.azurecr.io` as the default container image registry.
+- Add toggle for PSPs.
 
 ## [0.1.0] - 2023-07-21
 

diff --git a/helm/azure-private-endpoint-operator/templates/psp.yaml b/helm/azure-private-endpoint-operator/templates/psp.yaml
@@ -1,4 +1,4 @@
-{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }}
+{{- if not .Values.global.podSecurityStandards.enforced }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/helm/azure-private-endpoint-operator/templates/rbac.yaml b/helm/azure-private-endpoint-operator/templates/rbac.yaml
@@ -109,7 +109,7 @@ roleRef:
   name: {{ include "resource.default.name"  . }}
   apiGroup: rbac.authorization.k8s.io
 ---
-{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }}
+{{- if not .Values.global.podSecurityStandards.enforced }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

diff --git a/helm/azure-private-endpoint-operator/values.schema.json b/helm/azure-private-endpoint-operator/values.schema.json
@@ -2,6 +2,19 @@
     "$schema": "http://json-schema.org/schema#",
     "type": "object",
     "properties": {
+        "global": {
+            "type": "object",
+            "properties": {
+                "podSecurityStandards": {
+                    "type": "object",
+                    "properties": {
+                        "enforced": {
+                            "type": "boolean"
+                        }
+                    }
+                }
+            }
+        },
         "image": {
             "type": "object",
             "properties": {

diff --git a/helm/azure-private-endpoint-operator/values.yaml b/helm/azure-private-endpoint-operator/values.yaml
@@ -34,3 +34,7 @@ securityContext:
 managementCluster:
   name: PLACEHOLDER
   namespace: org-giantswarm
+
+global:
+  podSecurityStandards:
+    enforced: false