Skip to content

Commit a8fc75f

Browse files
ubergesundheitubergesundheit
authored
Remove PSP + PSP/PSS migration hacks (#443)
* Remove PSP + PSP/PSS migration hacks * Bump kubectl-apply-job to released 0.9.0 * Update helm values schema
1 parent fcbc868 commit a8fc75f

File tree

13 files changed

+41
-355
lines changed

13 files changed

+41
-355
lines changed

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
1414
- Revert `ingressController.admissionWebhook` settings to upstream values. (Enabled by default with `failurePolicy: Ignore`)
1515
- Update Kong Gateway image to `3.8.1.0-debian`
1616

17+
### Removed
18+
19+
- Keep PSP disabled by default and remove Giant Swarm PSP-PSS migration hacks
20+
1721
## [4.4.0] - 2024-08-19
1822

1923
### Changed

‎diffs/helm__kong-app__templates__psp.yaml.patch

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎diffs/helm__kong-app__values.yaml.patch

Lines changed: 12 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
diff --git a/vendor/kong/charts/kong/values.yaml b/helm/kong-app/values.yaml
2-
index 0f43f0e..c70688a 100644
2+
index 0f43f0e..1a37c28 100644
33
--- a/vendor/kong/charts/kong/values.yaml
44
+++ b/helm/kong-app/values.yaml
55
@@ -91,6 +91,7 @@ deployment:
@@ -93,7 +93,7 @@ index 0f43f0e..c70688a 100644
9393

9494
konnect:
9595
enabled: false
96-
@@ -733,12 +740,33 @@ postgresql:
96+
@@ -733,12 +740,31 @@ postgresql:
9797
username: kong
9898
database: kong
9999
image:
@@ -122,13 +122,11 @@ index 0f43f0e..c70688a 100644
122122
+ drop:
123123
+ - ALL
124124
+ rbac:
125-
+ create: true
126-
+ psp:
127125
+ create: true
128126

129127
# -----------------------------------------------------------------------------
130128
# Configure cert-manager integration
131-
@@ -819,7 +847,8 @@ waitImage:
129+
@@ -819,7 +845,8 @@ waitImage:
132130
# Optionally specify an image that provides bash for pre-migration database
133131
# checks. If none is specified, the chart uses the Kong image. The official
134132
# Kong images provide bash
@@ -138,7 +136,7 @@ index 0f43f0e..c70688a 100644
138136
# tag: 5
139137
pullPolicy: IfNotPresent
140138

141-
@@ -832,13 +861,13 @@ updateStrategy: {}
139+
@@ -832,13 +859,13 @@ updateStrategy: {}
142140

143141
# If you want to specify resources, uncomment the following
144142
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
@@ -159,7 +157,7 @@ index 0f43f0e..c70688a 100644
159157

160158
# readinessProbe for Kong pods
161159
readinessProbe:
162-
@@ -894,11 +923,44 @@ terminationGracePeriodSeconds: 30
160+
@@ -894,11 +921,44 @@ terminationGracePeriodSeconds: 30
163161

164162
# Affinity for pod assignment
165163
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
@@ -206,7 +204,7 @@ index 0f43f0e..c70688a 100644
206204

207205
# Tolerations for pod assignment
208206
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
209-
@@ -909,16 +971,14 @@ tolerations: []
207+
@@ -909,16 +969,14 @@ tolerations: []
210208
nodeSelector: {}
211209

212210
# Annotation to be added to Kong pods
@@ -225,7 +223,7 @@ index 0f43f0e..c70688a 100644
225223

226224
# Annotations to be added to Kong deployment
227225
deploymentAnnotations: {}
228-
@@ -942,29 +1002,52 @@ autoscaling:
226+
@@ -942,11 +1000,24 @@ autoscaling:
229227
type: Utilization
230228
averageUtilization: 80
231229

@@ -252,41 +250,7 @@ index 0f43f0e..c70688a 100644
252250
# minAvailable: "50%"
253251

254252
podSecurityPolicy:
255-
- enabled: false
256-
+ enabled: true
257-
labels: {}
258-
- annotations: {}
259-
+ annotations:
260-
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
261-
spec:
262-
privileged: false
263-
fsGroup:
264-
- rule: RunAsAny
265-
+ rule: MustRunAs
266-
+ ranges:
267-
+ - min: 1
268-
+ max: 65533
269-
runAsUser:
270-
- rule: RunAsAny
271-
+ rule: MustRunAsNonRoot
272-
runAsGroup:
273-
- rule: RunAsAny
274-
+ rule: MustRunAs
275-
+ ranges:
276-
+ - min: 1
277-
+ max: 65535
278-
seLinux:
279-
rule: RunAsAny
280-
supplementalGroups:
281-
- rule: RunAsAny
282-
+ rule: MustRunAs
283-
+ ranges:
284-
+ - min: 1
285-
+ max: 65535
286-
volumes:
287-
- 'configMap'
288-
- 'secret'
289-
@@ -982,13 +1065,19 @@ podSecurityPolicy:
253+
@@ -982,13 +1053,19 @@ podSecurityPolicy:
290254
priorityClassName: ""
291255

292256
# securityContext for Kong pods.
@@ -308,7 +272,7 @@ index 0f43f0e..c70688a 100644
308272
runAsNonRoot: true
309273
seccompProfile:
310274
type: RuntimeDefault
311-
@@ -1014,9 +1103,9 @@ serviceMonitor:
275+
@@ -1014,9 +1091,9 @@ serviceMonitor:
312276
# Specifies whether ServiceMonitor for Prometheus operator should be created
313277
# If you wish to gather metrics from a Kong instance with the proxy disabled (such as a hybrid control plane), see:
314278
# https://github.com/Kong/charts/blob/main/charts/kong/README.md#prometheus-operator-integration
@@ -320,7 +284,7 @@ index 0f43f0e..c70688a 100644
320284
# Specifies namespace, where ServiceMonitor should be installed
321285
# namespace: monitoring
322286
# labels:
323-
@@ -1026,7 +1115,15 @@ serviceMonitor:
287+
@@ -1026,7 +1103,15 @@ serviceMonitor:
324288

325289
# honorLabels: false
326290
# metricRelabelings: []
@@ -337,7 +301,7 @@ index 0f43f0e..c70688a 100644
337301

338302
# -----------------------------------------------------------------------------
339303
# Kong Enterprise parameters
340-
@@ -1036,12 +1133,12 @@ serviceMonitor:
304+
@@ -1036,12 +1121,12 @@ serviceMonitor:
341305
# RBAC and SMTP configuration have additional options that must all be set together
342306
# Other settings should be added to the "env" settings below
343307
enterprise:
@@ -352,7 +316,7 @@ index 0f43f0e..c70688a 100644
352316
vitals:
353317
enabled: true
354318
portal:
355-
@@ -1277,3 +1374,18 @@ extraObjects: []
319+
@@ -1277,3 +1362,9 @@ extraObjects: []
356320
# config:
357321
# per_consumer: false
358322
# plugin: prometheus
@@ -362,12 +326,3 @@ index 0f43f0e..c70688a 100644
362326
+kubectlApplyJob:
363327
+ files:
364328
+ - crds/custom-resource-definitions.yaml
365-
+ podSecurityPolicy:
366-
+ annotations:
367-
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
368-
+ securityContext:
369-
+ seccompProfileType: RuntimeDefault
370-
+
371-
+global:
372-
+ podSecurityStandards:
373-
+ enforced: false

‎helm/kong-app/Chart.lock

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ dependencies:
44
version: 11.9.13
55
- name: kubectl-apply-job
66
repository: oci://giantswarmpublic.azurecr.io/giantswarm-playground-catalog
7-
version: 0.8.0
8-
digest: sha256:e51bb892e434a9e518083a7fbe8944ccf709c269e91e7e7719b02955834c0c7c
9-
generated: "2024-07-08T16:50:20.619353016+02:00"
7+
version: 0.9.0
8+
digest: sha256:7065cc931b5106e74c171660d4b4a2dc0973890e8b9c6d0f3ad20cb7c73f4442
9+
generated: "2025-01-24T17:25:49.543767739+01:00"

‎helm/kong-app/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ dependencies:
2020
repository: oci://registry-1.docker.io/bitnamicharts
2121
condition: postgresql.enabled
2222
- name: kubectl-apply-job
23-
version: "0.8.0"
23+
version: "0.9.0"
2424
repository: oci://giantswarmpublic.azurecr.io/giantswarm-playground-catalog

‎helm/kong-app/templates/psp.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and (not .Values.global.podSecurityStandards.enforced) (.Values.podSecurityPolicy.enabled) (.Capabilities.APIVersions.Has "policy/v1beta1") }}
1+
{{- if and (.Values.podSecurityPolicy.enabled) }}
22
apiVersion: {{ include "kong.policyVersion" . }}
33
kind: PodSecurityPolicy
44
metadata:

‎helm/kong-app/values.schema.json

Lines changed: 1 addition & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -631,19 +631,6 @@
631631
"extraSecrets": {
632632
"type": "array"
633633
},
634-
"global": {
635-
"type": "object",
636-
"properties": {
637-
"podSecurityStandards": {
638-
"type": "object",
639-
"properties": {
640-
"enforced": {
641-
"type": "boolean"
642-
}
643-
}
644-
}
645-
}
646-
},
647634
"image": {
648635
"type": "object",
649636
"properties": {
@@ -989,27 +976,6 @@
989976
"items": {
990977
"type": "string"
991978
}
992-
},
993-
"podSecurityPolicy": {
994-
"type": "object",
995-
"properties": {
996-
"annotations": {
997-
"type": "object",
998-
"properties": {
999-
"seccomp.security.alpha.kubernetes.io/allowedProfileNames": {
1000-
"type": "string"
1001-
}
1002-
}
1003-
}
1004-
}
1005-
},
1006-
"securityContext": {
1007-
"type": "object",
1008-
"properties": {
1009-
"seccompProfileType": {
1010-
"type": "string"
1011-
}
1012-
}
1013979
}
1014980
}
1015981
},
@@ -1209,12 +1175,7 @@
12091175
"type": "object",
12101176
"properties": {
12111177
"annotations": {
1212-
"type": "object",
1213-
"properties": {
1214-
"seccomp.security.alpha.kubernetes.io/allowedProfileNames": {
1215-
"type": "string"
1216-
}
1217-
}
1178+
"type": "object"
12181179
},
12191180
"enabled": {
12201181
"type": "boolean"
@@ -1231,20 +1192,6 @@
12311192
"fsGroup": {
12321193
"type": "object",
12331194
"properties": {
1234-
"ranges": {
1235-
"type": "array",
1236-
"items": {
1237-
"type": "object",
1238-
"properties": {
1239-
"max": {
1240-
"type": "integer"
1241-
},
1242-
"min": {
1243-
"type": "integer"
1244-
}
1245-
}
1246-
}
1247-
},
12481195
"rule": {
12491196
"type": "string"
12501197
}
@@ -1268,20 +1215,6 @@
12681215
"runAsGroup": {
12691216
"type": "object",
12701217
"properties": {
1271-
"ranges": {
1272-
"type": "array",
1273-
"items": {
1274-
"type": "object",
1275-
"properties": {
1276-
"max": {
1277-
"type": "integer"
1278-
},
1279-
"min": {
1280-
"type": "integer"
1281-
}
1282-
}
1283-
}
1284-
},
12851218
"rule": {
12861219
"type": "string"
12871220
}
@@ -1306,20 +1239,6 @@
13061239
"supplementalGroups": {
13071240
"type": "object",
13081241
"properties": {
1309-
"ranges": {
1310-
"type": "array",
1311-
"items": {
1312-
"type": "object",
1313-
"properties": {
1314-
"max": {
1315-
"type": "integer"
1316-
},
1317-
"min": {
1318-
"type": "integer"
1319-
}
1320-
}
1321-
}
1322-
},
13231242
"rule": {
13241243
"type": "string"
13251244
}
@@ -1585,14 +1504,6 @@
15851504
}
15861505
}
15871506
},
1588-
"psp": {
1589-
"type": "object",
1590-
"properties": {
1591-
"create": {
1592-
"type": "boolean"
1593-
}
1594-
}
1595-
},
15961507
"rbac": {
15971508
"type": "object",
15981509
"properties": {

0 commit comments

Comments
 (0)