Merge pull request #120 from shafeeqes/enh/podsecurity

Don't deploy `PSP`s when `PodSecurityPolicy` plugin is disabled
gardener · Aug 22, 2022 · 6995f1a · 6995f1a
2 parents 4f3fce1 + e698579
commit 6995f1a
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 2 deletions.
diff --git a/charts/internal/cilium/charts/agent/templates/daemonset.yaml b/charts/internal/cilium/charts/agent/templates/daemonset.yaml
@@ -528,6 +528,10 @@ spec:
 {{- if and (eq .Release.Namespace "kube-system") (or (gt .Capabilities.KubeVersion.Minor "10") (gt .Capabilities.KubeVersion.Major "1"))}}
       priorityClassName: system-node-critical
 {{- end }}
+      securityContext:
+        fsGroup: 1
+        supplementalGroups:
+        - 1
       serviceAccount: "cilium"
       serviceAccountName: "cilium"
       terminationGracePeriodSeconds: 1

diff --git a/charts/internal/cilium/charts/operator/templates/deployment.yaml b/charts/internal/cilium/charts/operator/templates/deployment.yaml
@@ -42,6 +42,14 @@ spec:
             topologyKey: kubernetes.io/hostname
       nodeSelector:
         kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 1
+        supplementalGroups:
+        - 1
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
       containers:
       - name: cilium-operator
         command:

diff --git a/pkg/charts/utils.go b/pkg/charts/utils.go
@@ -160,12 +160,17 @@ func generateChartValues(config *ciliumv1alpha1.NetworkConfig, network *extensio
 		globalConfig.LocalRedirectPolicy.Enabled = true
 	}
 
+	// disable PSPs if it's disabled in the shoot
+	if helper.IsPSPDisabled(cluster.Shoot) {
+		globalConfig.Psp.Enabled = false
+	}
+
 	if config == nil {
 		return requirementsConfig, globalConfig, nil
 	}
 
-	// check if PSPs are enabled
-	if config.PSPEnabled != nil {
+	// do not overwrite if it's set to false before, otherwise use the value from the config
+	if globalConfig.Psp.Enabled && config.PSPEnabled != nil {
 		globalConfig.Psp.Enabled = *config.PSPEnabled
 	}