Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Remove PSP support #609

Merged
merged 1 commit into from
Dec 5, 2023
+1 −382
Merged

chore: Remove PSP support #609

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,9 +245,6 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
$(KUSTOMIZE) build config/default | kubectl apply -f -
kubectl apply -f hack/crds/*

deploy-with-psp: deploy ## Deploy controller to the K8s cluster specified in ~/.kube/config and apply privileged pod security policy
$(KUSTOMIZE) build config/psp | kubectl apply -f -

undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
$(KUSTOMIZE) build config/default | kubectl delete -f -
$(KUSTOMIZE) build config/resources-namespace | kubectl delete -f -
Expand Down
4 changes: 0 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@
- [IPoIBNetwork CRD](#ipoibnetwork-crd)
- [IPoIBNetwork spec:](#ipoibnetwork-spec)
- [Example for IPoIBNetwork resource:](#example-for-ipoibnetwork-resource)
- [Pod Security Policy](#pod-security-policy)
- [System Requirements](#system-requirements)
- [Tested Network Adapters](#tested-network-adapters)
- [Compatibility Notes](#compatibility-notes)
Expand Down Expand Up @@ -414,9 +413,6 @@ spec:
Can be found at: `example/crs/mellanox.com_v1alpha1_ipoibnetwork_cr.yaml`
## Pod Security Policy
NVIDIA Network Operator supports [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). When NicClusterPolicy is created with `psp.enabled=True`, privileged PSP is created and applied to all network-operator's pods. Requires [admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in) to be enabled.
## System Requirements
* RDMA capable hardware: Mellanox ConnectX-5 NIC or newer.
* NVIDIA GPU and driver supporting GPUDirect e.g Quadro RTX 6000/8000 or Tesla T4 or Tesla V100 or Tesla V100.
Expand Down
9 changes: 0 additions & 9 deletions api/v1alpha1/nicclusterpolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,14 +180,6 @@ type SecondaryNetworkSpec struct {
IpamPlugin *ImageSpec `json:"ipamPlugin,omitempty"`
}

// PSPSpec describes configuration for PodSecurityPolicies to apply for all Pods
type PSPSpec struct {
// Enabled indicates if PodSecurityPolicies needs to be enabled for all Pods
// +optional
// +kubebuilder:default:=false
Enabled bool `json:"enabled,omitempty"`
}

// IBKubernetesSpec describes configuration options for ib-kubernetes
type IBKubernetesSpec struct {
// Image information for ib-kubernetes
Expand Down Expand Up @@ -233,7 +225,6 @@ type NicClusterPolicySpec struct {
IBKubernetes *IBKubernetesSpec `json:"ibKubernetes,omitempty"`
SecondaryNetwork *SecondaryNetworkSpec `json:"secondaryNetwork,omitempty"`
NvIpam *NVIPAMSpec `json:"nvIpam,omitempty"`
PSP *PSPSpec `json:"psp,omitempty"`
NicFeatureDiscovery *NICFeatureDiscoverySpec `json:"nicFeatureDiscovery,omitempty"`
}

Expand Down
20 changes: 0 additions & 20 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 0 additions & 10 deletions bundle/manifests/mellanox.com_nicclusterpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -580,16 +580,6 @@ spec:
- repository
- version
type: object
psp:
description: PSPSpec describes configuration for PodSecurityPolicies
to apply for all Pods
properties:
enabled:
default: false
description: Enabled indicates if PodSecurityPolicies needs to
be enabled for all Pods
type: boolean
type: object
rdmaSharedDevicePlugin:
description: DevicePluginSpec describes configuration options for
device plugin 1. Image information for device plugin 2. Device plugin
Expand Down
12 changes: 0 additions & 12 deletions bundle/manifests/nvidia-network-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -445,18 +445,6 @@ spec:
- get
- patch
- update
- apiGroups:
- policy
resources:
- podsecuritypolicies
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
10 changes: 0 additions & 10 deletions config/crd/bases/mellanox.com_nicclusterpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -581,16 +581,6 @@ spec:
- repository
- version
type: object
psp:
description: PSPSpec describes configuration for PodSecurityPolicies
to apply for all Pods
properties:
enabled:
default: false
description: Enabled indicates if PodSecurityPolicies needs to
be enabled for all Pods
type: boolean
type: object
rdmaSharedDevicePlugin:
description: DevicePluginSpec describes configuration options for
device plugin 1. Image information for device plugin 2. Device plugin
Expand Down
7 changes: 0 additions & 7 deletions config/psp/kustomization.yaml
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions config/psp/manager_psp_role.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions config/psp/manager_psp_rolebinding.yaml
View file
Open in desktop

This file was deleted.

31 changes: 0 additions & 31 deletions config/psp/pod_security_policy.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,18 +316,6 @@ rules:
- get
- patch
- update
- apiGroups:
- policy
resources:
- podsecuritypolicies
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
1 change: 0 additions & 1 deletion controllers/nicclusterpolicy_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,6 @@ type NicClusterPolicyReconciler struct {
// +kubebuilder:rbac:groups=mellanox.com,resources=nicclusterpolicies/finalizers,verbs=update
// +kubebuilder:rbac:groups=security.openshift.io,resourceNames=privileged,resources=securitycontextconstraints,verbs=use
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=policy,resources=podsecuritypolicies,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch;update
// +kubebuilder:rbac:groups="",resources=namespaces;serviceaccounts;pods;pods/status;services;services/finalizers;endpoints,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims;events;configmaps;secrets,verbs=get;list;watch;create;update;patch;delete
Expand Down
1 change: 0 additions & 1 deletion deployment/network-operator/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,7 +373,6 @@ parameters.
| `sriovNetworkOperator.enabled` | bool | `False` | deploy SR-IOV Network Operator |
| `upgradeCRDs` | bool | `True` | enable CRDs upgrade with helm pre-install and pre-upgrade hooks |
| `sriovNetworkOperator.configDaemonNodeSelectorExtra` | object | `{"node-role.kubernetes.io/worker": ""}` | Additional nodeSelector for sriov-network-operator config daemon. These values will be added in addition to default values managed by the network-operator. |
| `psp.enabled` | bool | `False` | deploy Pod Security Policy |
| `imagePullSecrets` | list | `[]` | An optional list of references to secrets to use for pulling any of the Network Operator image if it's not overrided |
| `operator.repository` | string | `nvcr.io/nvidia/cloud-native` | Network Operator image repository |
| `operator.image` | string | `network-operator` | Network Operator image name |
Expand Down
10 changes: 0 additions & 10 deletions deployment/network-operator/crds/mellanox.com_nicclusterpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -581,16 +581,6 @@ spec:
- repository
- version
type: object
psp:
description: PSPSpec describes configuration for PodSecurityPolicies
to apply for all Pods
properties:
enabled:
default: false
description: Enabled indicates if PodSecurityPolicies needs to
be enabled for all Pods
type: boolean
type: object
rdmaSharedDevicePlugin:
description: DevicePluginSpec describes configuration options for
device plugin 1. Image information for device plugin 2. Device plugin
Expand Down
2 changes: 0 additions & 2 deletions deployment/network-operator/templates/mellanox.com_v1alpha1_nicclusterpolicy_cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,8 +174,6 @@ spec:
imagePullSecrets: {{ include "network-operator.secondaryNetwork.ipamPlugin.imagePullSecrets" . }}
{{- end }}
{{- end }}
psp:
enabled: {{ .Values.psp.enabled }}
{{- if .Values.nvIpam.deploy }}
nvIpam:
image: {{ .Values.nvIpam.image }}
Expand Down
35 changes: 0 additions & 35 deletions deployment/network-operator/templates/podsecuritypolicy.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions deployment/network-operator/templates/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,18 +330,6 @@ rules:
- get
- patch
- update
- apiGroups:
- policy
resources:
- podsecuritypolicies
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
3 changes: 0 additions & 3 deletions deployment/network-operator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,6 @@ nfd:
enabled: true
deployNodeFeatureRules: true

psp:
enabled: false

upgradeCRDs: true

sriovNetworkOperator:
Expand Down
3 changes: 0 additions & 3 deletions hack/templates/values/values.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,6 @@ nfd:
enabled: true
deployNodeFeatureRules: true

psp:
enabled: false

upgradeCRDs: true

sriovNetworkOperator:
Expand Down
13 changes: 0 additions & 13 deletions manifests/state-pod-security-policy/0100_role.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions manifests/state-pod-security-policy/0200_role_binding.yaml
View file
Open in desktop

This file was deleted.

7 changes: 1 addition & 6 deletions pkg/state/factory.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,11 +108,6 @@ func newNicClusterPolicyStates(k8sAPIClient client.Client, scheme *runtime.Schem
if err != nil {
return nil, errors.Wrapf(err, "failed to create Whereabouts CNI State")
}
podSecurityPolicyState, err := NewStatePodSecurityPolicy(
k8sAPIClient, scheme, filepath.Join(manifestBaseDir, "state-pod-security-policy"))
if err != nil {
return nil, errors.Wrapf(err, "failed to create Pod Security Policy State")
}
ibKubernetesState, err := NewStateIBKubernetes(
k8sAPIClient, scheme, filepath.Join(manifestBaseDir, "state-ib-kubernetes"))
if err != nil {
Expand All @@ -130,7 +125,7 @@ func newNicClusterPolicyStates(k8sAPIClient client.Client, scheme *runtime.Schem
}

return []State{
podSecurityPolicyState, multusState, cniPluginsState, ipoibState, whereaboutState,
multusState, cniPluginsState, ipoibState, whereaboutState,
ofedState, sriovDpState, sharedDpState, ibKubernetesState, nvIpamCniState,
nicFeatureDiscoveryState}, nil
}
Expand Down
Loading
Loading