fix: disable psp as default (open-policy-agent#3179)

Signed-off-by: Rita Zhang <[email protected]>
softlee-io · Apr 1, 2024 · 7fed17f · 7fed17f
1 parent bd75c0c
commit 7fed17f
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/cmd/build/helmify/static/README.md b/cmd/build/helmify/static/README.md
@@ -120,7 +120,7 @@ information._
 | preUninstall.nodeSelector                                  | The node selector to use for pod scheduling in preUninstall hook jobs                                                                                                                                                                                                                          | `kubernetes.io/os: linux`                                                                                                                                             |
 | preUninstall.resources                                     | The resource request/limits for the container image in preUninstall hook jobs                                                                                                                                                                                                                  | `{}`                                                                                                                                                                  |
 | preUninstall.securityContext                               | Security context applied on the container                                                                                                                                                                                                                                                      | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }`    |
-| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `true`                                                                                                                                                                |
+| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `false`                                                                                                                                                                |
 | upgradeCRDs.enabled                                        | Upgrade CRDs using pre-install/pre-upgrade hooks                                                                                                                                                                                                                                               | `true`                                                                                                                                                                |
 | upgradeCRDs.extraRules                                     | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole                                                                                                                                                                                                                                  | `[]`                                                                                                                                                                  |
 | upgradeCRDs.priorityClassName                              | Priority class name for gatekeeper-update-crds-hook Job                                                                                                                                                                                                                                        | ``                                                                                                                                                                    |

diff --git a/cmd/build/helmify/static/values.yaml b/cmd/build/helmify/static/values.yaml
@@ -266,7 +266,7 @@ pdb:
 service: {}
 disabledBuiltins: ["{http.send}"]
 psp:
-  enabled: true
+  enabled: false
 upgradeCRDs:
   enabled: true
   extraRules: []

diff --git a/manifest_staging/charts/gatekeeper/README.md b/manifest_staging/charts/gatekeeper/README.md
@@ -120,7 +120,7 @@ information._
 | preUninstall.nodeSelector                                  | The node selector to use for pod scheduling in preUninstall hook jobs                                                                                                                                                                                                                          | `kubernetes.io/os: linux`                                                                                                                                             |
 | preUninstall.resources                                     | The resource request/limits for the container image in preUninstall hook jobs                                                                                                                                                                                                                  | `{}`                                                                                                                                                                  |
 | preUninstall.securityContext                               | Security context applied on the container                                                                                                                                                                                                                                                      | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }`    |
-| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `true`                                                                                                                                                                |
+| psp.enabled                                                | Enabled PodSecurityPolicy                                                                                                                                                                                                                                                                      | `false`                                                                                                                                                                |
 | upgradeCRDs.enabled                                        | Upgrade CRDs using pre-install/pre-upgrade hooks                                                                                                                                                                                                                                               | `true`                                                                                                                                                                |
 | upgradeCRDs.extraRules                                     | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole                                                                                                                                                                                                                                  | `[]`                                                                                                                                                                  |
 | upgradeCRDs.priorityClassName                              | Priority class name for gatekeeper-update-crds-hook Job                                                                                                                                                                                                                                        | ``                                                                                                                                                                    |

diff --git a/manifest_staging/charts/gatekeeper/values.yaml b/manifest_staging/charts/gatekeeper/values.yaml
@@ -266,7 +266,7 @@ pdb:
 service: {}
 disabledBuiltins: ["{http.send}"]
 psp:
-  enabled: true
+  enabled: false
 upgradeCRDs:
   enabled: true
   extraRules: []