From fbdc9a1b3ef338c149520b2204851e5ea6ba1426 Mon Sep 17 00:00:00 2001 From: Xun Jiang Date: Fri, 17 Feb 2023 15:30:21 +0800 Subject: [PATCH] Add labels for created namespace during velero installation to adopt k8s v1.25's PSS and PSA. Signed-off-by: Xun Jiang --- changelogs/unreleased/5873-blackpiglet | 1 + pkg/install/resources.go | 7 ++++++- pkg/install/resources_test.go | 5 +++++ 3 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 changelogs/unreleased/5873-blackpiglet diff --git a/changelogs/unreleased/5873-blackpiglet b/changelogs/unreleased/5873-blackpiglet new file mode 100644 index 00000000000..3ee3fb4d7a0 --- /dev/null +++ b/changelogs/unreleased/5873-blackpiglet @@ -0,0 +1 @@ +Add labels for velero installed namespace to support PSA. \ No newline at end of file diff --git a/pkg/install/resources.go b/pkg/install/resources.go index 78a9ed68913..d66e11872e1 100644 --- a/pkg/install/resources.go +++ b/pkg/install/resources.go @@ -136,13 +136,18 @@ func ClusterRoleBinding(namespace string) *rbacv1.ClusterRoleBinding { } func Namespace(namespace string) *corev1.Namespace { - return &corev1.Namespace{ + ns := &corev1.Namespace{ ObjectMeta: objectMeta("", namespace), TypeMeta: metav1.TypeMeta{ Kind: "Namespace", APIVersion: corev1.SchemeGroupVersion.String(), }, } + + ns.Labels["pod-security.kubernetes.io/enforce"] = "privileged" + ns.Labels["pod-security.kubernetes.io/enforce-version"] = "latest" + + return ns } func BackupStorageLocation(namespace, provider, bucket, prefix string, config map[string]string, caCert []byte) *velerov1api.BackupStorageLocation { diff --git a/pkg/install/resources_test.go b/pkg/install/resources_test.go index 748d70defe3..298dca9eb7d 100644 --- a/pkg/install/resources_test.go +++ b/pkg/install/resources_test.go @@ -40,6 +40,11 @@ func TestResources(t *testing.T) { ns := Namespace("velero") assert.Equal(t, "velero", ns.Name) + // For k8s version v1.25 and later, need to add the following labels to make + // velero installation namespace has privileged version to work with + // PSA(Pod Security Admission) and PSS(Pod Security Standards). + assert.Equal(t, ns.Labels["pod-security.kubernetes.io/enforce"], "privileged") + assert.Equal(t, ns.Labels["pod-security.kubernetes.io/enforce-version"], "latest") crb := ClusterRoleBinding(DefaultVeleroNamespace) // The CRB is a cluster-scoped resource