🐛 (fix): update PSA versions to match Kubernetes API version#3524
Conversation
camilamacedo86
force-pushed
the
update-k8s-psa-version-based-go-mod
branch
from
7c523ea to
bf22f4d
Compare
camilamacedo86
changed the title
camilamacedo86
force-pushed
the
update-k8s-psa-version-based-go-mod
branch
2 times, most recently
from
d0e7f44 to
a427abf
Compare
|
@camilamacedo86 I think this change looks okay, but if we're going to touch these anyway, does it make sense for us to revisit #2906 at this point? We've default to baseline enforcement for the last ~2 years. At this point I expect that everyone should be using catalog binaries that can handle restricted enforcement Maybe not part of this pr, but should we create an issue? |
In this commit, a new Makefile target `update-k8s-values` was created to automatically update the `pod-security.kubernetes.io/*-version` values (`enforceVersion`, `auditVersion`, `warnVersion`) in the Helm chart's `values.yaml` file. These values now align with the Kubernetes API version defined in `go.mod`, instead of using `latest`. This ensures better compatibility and avoids issues with unsupported versions in Kubernetes PSA.
camilamacedo86
force-pushed
the
update-k8s-psa-version-based-go-mod
branch
from
a427abf to
5b4222f
Compare
|
Hi @kevinrizza Thank you for the help! |
anik120
left a comment
anik120
left a comment
There was a problem hiding this comment.
/lgtm
At this point I expect that everyone should be using catalog binaries that can handle restricted enforcement
Note that we'll have to dig up why exactly the catalog binaries weren't able to handle the restricted environment, to confirm to ourselves that our customers are off of that issue (I can't remember off the top of my head what exactly the issue was)
|
Based on https://redhat-internal.slack.com/archives/C06KP34REFJ/p1741224828143489?thread_ts=1739880491.760029&cid=C06KP34REFJ, we are fine to leave our namespace manifest with latest since it doesn't appear hypershift is using it, "latest" means the-version-of-the-control-plane-that-is-running-psa-logic-for-this-namespace. So these pinning PRs appear not needed. So, we should revert this PR. we should revert this change. |
…)" This reverts commit efe3a9a.
5 participants
In this commit, a new Makefile target
update-k8s-valueswas created to automatically update thepod-security.kubernetes.io/*-versionvalues (enforceVersion,auditVersion,warnVersion)in the Helm chart's
values.yamlfile.These values now align with the Kubernetes API version defined in
go.mod, instead of usinglatest. This ensures better compatibility and avoids issues with unsupported versions in Kubernetes PSA.