PodSecurityPolicy removed in Kubernetes 1.25 #1447
Comments
|
We are tracking our alternative to PSP deprecation in tektoncd/pipeline#4112 |
|
We need to port tektoncd/pipeline#5536 to Triggers |
|
tektoncd/pipeline#5652 added PSA restricted to the entire tekton-pipelines namespace which means triggers controllers will fail to come up with Pipeline v0.41 |
dibyom
added a commit
to dibyom/triggers
that referenced
this issue
Nov 3, 2022
This commit drops the Triggers PodSecurityPolicy since its deprecated and is going to be removed in Kubernetes 1.25 in favor of PodSecurityAdmission. In addition, it adds the `securityContext` required for the "restricted" PodSecurityAdmission levels. These changes are necessary for Triggers to work with Pipelines v0.41 and higher because tektoncd/pipeline#5652 started enforcing the restricted pod security level for all pods in the `tekton-pipelines` namespace (which includes the triggers controller, webhook, and core interceptor deployments). Fixes tektoncd#1447 and required for tektoncd#1475 Signed-off-by: Dibyo Mukherjee <dibyo@google.com>
4 tasks
|
@dibyom I see your PR for this issue so assigned to you |
dibyom
added a commit
to dibyom/triggers
that referenced
this issue
Nov 3, 2022
This commit drops the Triggers PodSecurityPolicy since its deprecated and is going to be removed in Kubernetes 1.25 in favor of PodSecurityAdmission. In addition, it adds the `securityContext` required for the "restricted" PodSecurityAdmission levels. These changes are necessary for Triggers to work with Pipelines v0.41 and higher because tektoncd/pipeline#5652 started enforcing the restricted pod security level for all pods in the `tekton-pipelines` namespace (which includes the triggers controller, webhook, and core interceptor deployments). Fixes tektoncd#1447 and required for tektoncd#1475 Signed-off-by: Dibyo Mukherjee <dibyo@google.com>
tekton-robot
pushed a commit
that referenced
this issue
Nov 4, 2022
This commit drops the Triggers PodSecurityPolicy since its deprecated and is going to be removed in Kubernetes 1.25 in favor of PodSecurityAdmission. In addition, it adds the `securityContext` required for the "restricted" PodSecurityAdmission levels. These changes are necessary for Triggers to work with Pipelines v0.41 and higher because tektoncd/pipeline#5652 started enforcing the restricted pod security level for all pods in the `tekton-pipelines` namespace (which includes the triggers controller, webhook, and core interceptor deployments). Fixes #1447 and required for #1475 Signed-off-by: Dibyo Mukherjee <dibyo@google.com>
Repository owner
moved this from Todo
to Done
in Tekton Community Roadmap
Nov 4, 2022
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Expected Behavior
The released deployment manifest doesn't have deprecated resources listed in it.
Actual Behavior
PodSecurityPolicy tekton-pipelines is listed in the deployment manifest which is a deprecated resource as of 1.21 and will be deleted in 1.25.
Steps to Reproduce the Problem
Additional Info
Kubernetes version: 1.24
Output of
kubectl version:Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.4", GitCommit:"95ee5ab382d64cfe6c28967f36b53970b8374491", GitTreeState:"clean", BuildDate:"2022-08-17T18:54:23Z", GoVersion:"go1.18.5", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.4
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.2", GitCommit:"f66044f4361b9f1f96f0053dd46cb7dce5e990a8", GitTreeState:"clean", BuildDate:"2022-06-15T14:15:38Z", GoVersion:"go1.18.3", Compiler:"gc", Platform:"linux/amd64"}
The text was updated successfully, but these errors were encountered: