diff --git a/CHANGELOG.md b/CHANGELOG.md index 941d15d..9fd9bf8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,10 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s - Explicitly expose liveness and readiness probe ports in deployments. +### Removed + +- Remove PodSecurityPolicy and associated Resources and values. + ## [1.22.0] - 2024-09-10 ### Changed diff --git a/helm/coredns-app/templates/psp.yaml b/helm/coredns-app/templates/psp.yaml deleted file mode 100644 index dd7e028..0000000 --- a/helm/coredns-app/templates/psp.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- if and (le (int .Capabilities.KubeVersion.Minor) 24) (not .Values.global.podSecurityStandards.enforced) }} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ .Values.name }} - annotations: - seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default' - labels: - {{- include "labels.common" . | nindent 4 }} -spec: - privileged: false - allowPrivilegeEscalation: false - # Add back CAP_NET_BIND_SERVICE so that coredns can run on port 53 - allowedCapabilities: - - NET_BIND_SERVICE - volumes: - - 'configMap' - - 'emptyDir' - - 'projected' - - 'secret' - - 'downwardAPI' - hostNetwork: false - hostIPC: false - hostPID: false - runAsUser: - rule: 'MustRunAsNonRoot' - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - fsGroup: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - readOnlyRootFilesystem: false -{{- end }} diff --git a/helm/coredns-app/templates/rbac.yaml b/helm/coredns-app/templates/rbac.yaml index 2db2633..9f8af56 100644 --- a/helm/coredns-app/templates/rbac.yaml +++ b/helm/coredns-app/templates/rbac.yaml @@ -23,15 +23,6 @@ rules: verbs: - watch - list -- apiGroups: - - policy - - extensions - resources: - - podsecuritypolicies - verbs: - - use - resourceNames: - - {{ .Values.name }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/helm/coredns-app/values.schema.json b/helm/coredns-app/values.schema.json index c8b1072..f716a47 100644 --- a/helm/coredns-app/values.schema.json +++ b/helm/coredns-app/values.schema.json @@ -53,19 +53,6 @@ } } }, - "global": { - "type": "object", - "properties": { - "podSecurityStandards": { - "type": "object", - "properties": { - "enforced": { - "type": "boolean" - } - } - } - } - }, "groupID": { "type": "integer" }, diff --git a/helm/coredns-app/values.yaml b/helm/coredns-app/values.yaml index 058a94a..750b92a 100644 --- a/helm/coredns-app/values.yaml +++ b/helm/coredns-app/values.yaml @@ -82,10 +82,5 @@ mastersInstance: nodeSelector: "node-role.kubernetes.io/control-plane": '""' - -global: - podSecurityStandards: - enforced: false - # Uncomment and define `additionalLocalZones` to add additional local zones to CoreDNS config # additionalLocalZones: []