Add psp.enabled field to disable PSP objects

Signed-off-by: Tamal Saha <[email protected]>
kubedb · Oct 12, 2023 · da0f398 · da0f398
1 parent e3a6603
commit da0f398
Show file tree

Hide file tree

Showing 28 changed files with 84 additions and 14 deletions.
diff --git a/apis/installer/v1alpha1/kubedb_catalog_types.go b/apis/installer/v1alpha1/kubedb_catalog_types.go
@@ -84,6 +84,7 @@ type Catalog struct {
 }
 
 type PSP struct {
+	Enabled bool `json:"enabled"`
 	//+optional
 	Elasticsearch PSPElasticsearch `json:"elasticsearch"`
 	//+optional

diff --git a/apis/installer/v1alpha1/kubedb_ops_manager_types.go b/apis/installer/v1alpha1/kubedb_ops_manager_types.go
@@ -81,6 +81,7 @@ type KubedbOpsManagerSpec struct {
 	LicenseSecretName string `json:"licenseSecretName"`
 	// +optional
 	RecommendationEngine RecommendationEngineConfig `json:"recommendationEngine"`
+	Psp                  PSPSpec                    `json:"psp"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

diff --git a/apis/installer/v1alpha1/kubedb_provisioner_types.go b/apis/installer/v1alpha1/kubedb_provisioner_types.go
@@ -82,7 +82,8 @@ type KubedbProvisionerSpec struct {
 	// +optional
 	License string `json:"license"`
 	// +optional
-	LicenseSecretName string `json:"licenseSecretName"`
+	LicenseSecretName string  `json:"licenseSecretName"`
+	Psp               PSPSpec `json:"psp"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

diff --git a/apis/installer/v1alpha1/types.go b/apis/installer/v1alpha1/types.go
@@ -96,3 +96,6 @@ type EASMonitoring struct {
 	Agent          MonitoringAgent      `json:"agent"`
 	ServiceMonitor ServiceMonitorLabels `json:"serviceMonitor"`
 }
+type PSPSpec struct {
+	Enabled bool `json:"enabled"`
+}
diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go
diff --git a/charts/kubedb-catalog/README.md b/charts/kubedb-catalog/README.md
@@ -64,6 +64,7 @@ The following table lists the configurable parameters of the `kubedb-catalog` ch
 | catalog.proxysql                           | If true, deploys ProxySQL version catalog                                                                                              | <code>true</code>  |
 | catalog.redis                              | If true, deploys Redis version catalog                                                                                                 | <code>true</code>  |
 | catalog.kafka                              |                                                                                                                                        | <code>true</code>  |
+| psp.enabled                                |                                                                                                                                        | <code>true</code>  |
 | psp.elasticsearch.allowPrivilegeEscalation |                                                                                                                                        | <code>true</code>  |
 | psp.elasticsearch.privileged               |                                                                                                                                        | <code>true</code>  |
 | psp.mariadb.allowPrivilegeEscalation       |                                                                                                                                        | <code>false</code> |

diff --git a/charts/kubedb-catalog/templates/elasticsearch/elasticsearch-psp.yaml b/charts/kubedb-catalog/templates/elasticsearch/elasticsearch-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.elasticsearch }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.elasticsearch }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/kafka/kafka-psp.yaml b/charts/kubedb-catalog/templates/kafka/kafka-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.kafka }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.kafka }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/mariadb/mariadb-psp.yaml b/charts/kubedb-catalog/templates/mariadb/mariadb-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.mariadb }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.mariadb }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/memcached/memcached-psp.yaml b/charts/kubedb-catalog/templates/memcached/memcached-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.memcached }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.memcached }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/mongodb/mongodb-psp.yaml b/charts/kubedb-catalog/templates/mongodb/mongodb-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.mongodb }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.mongodb }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/mysql/mysql-psp.yaml b/charts/kubedb-catalog/templates/mysql/mysql-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.mysql }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.mysql }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/perconaxtradb/perconaxtradb-psp.yaml b/charts/kubedb-catalog/templates/perconaxtradb/perconaxtradb-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.perconaxtradb }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.perconaxtradb }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/postgres/postgres-psp.yaml b/charts/kubedb-catalog/templates/postgres/postgres-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.postgres }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.postgres }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/proxysql/proxysql-psp.yaml b/charts/kubedb-catalog/templates/proxysql/proxysql-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.proxysql }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.proxysql }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/templates/redis/redis-psp.yaml b/charts/kubedb-catalog/templates/redis/redis-psp.yaml
@@ -1,4 +1,4 @@
-{{ if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.redis }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.catalog.redis }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-catalog/values.openapiv3_schema.yaml b/charts/kubedb-catalog/values.openapiv3_schema.yaml
@@ -52,6 +52,8 @@ properties:
         - allowPrivilegeEscalation
         - privileged
         type: object
+      enabled:
+        type: boolean
       kafka:
         properties:
           allowPrivilegeEscalation:
@@ -143,6 +145,7 @@ properties:
         - privileged
         type: object
     required:
+    - enabled
     - kafka
     type: object
   registryFQDN:

diff --git a/charts/kubedb-catalog/values.yaml b/charts/kubedb-catalog/values.yaml
@@ -45,6 +45,7 @@ catalog:
   kafka: true
 
 psp:
+  enabled: true
   elasticsearch:
     allowPrivilegeEscalation: true
     privileged: true

diff --git a/charts/kubedb-ops-manager/README.md b/charts/kubedb-ops-manager/README.md
@@ -82,6 +82,7 @@ The following table lists the configurable parameters of the `kubedb-ops-manager
 | recommendationEngine.genRotateTLSRecommendationBeforeExpiryYear  | Rotate TLS recommendation will be generated before given year of expiration. It also depends on gen-rotate-tls-recommendation-before-expiry-month and gen-rotate-tls-recommendation-before-expiry-year. Default values are 0(zero) for gen-rotate-tls-recommendation-before-expiry-year, 1(one) for gen-rotate-tls-recommendation-before-expiry-month, 0(zero) for gen-rotate-tls-recommendation-before-expiry-day flags. | <code>0</code>                                                                                                                                      |
 | recommendationEngine.genRotateTLSRecommendationBeforeExpiryMonth | Rotate TLS recommendation will be generated before given month of expiration. It also depends on gen-rotate-tls-recommendation-before-expiry-year and gen-rotate-tls-recommendation-before-expiry-day flag. By default it is set as 1(one).                                                                                                                                                                               | <code>1</code>                                                                                                                                      |
 | recommendationEngine.genRotateTLSRecommendationBeforeExpiryDay   | Rotate TLS recommendation will be generated before given day of expiration. It also depends on gen-rotate-tls-recommendation-before-expiry-year and gen-rotate-tls-recommendation-before-expiry-month flag. By default it is set as 0(zero).                                                                                                                                                                              | <code>0</code>                                                                                                                                      |
+| psp.enabled                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                           | <code>true</code>                                                                                                                                   |
 
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:

diff --git a/charts/kubedb-ops-manager/templates/operator-psp.yaml b/charts/kubedb-ops-manager/templates/operator-psp.yaml
@@ -1,4 +1,4 @@
-{{ if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-ops-manager/values.openapiv3_schema.yaml b/charts/kubedb-ops-manager/values.openapiv3_schema.yaml
@@ -1169,6 +1169,13 @@ properties:
             type: string
         type: object
     type: object
+  psp:
+    properties:
+      enabled:
+        type: boolean
+    required:
+    - enabled
+    type: object
   recommendationEngine:
     properties:
       genRotateTLSRecommendationBeforeExpiryDay:
@@ -1246,6 +1253,7 @@ required:
 - insecureRegistries
 - monitoring
 - operator
+- psp
 - registryFQDN
 - replicaCount
 - serviceAccount

diff --git a/charts/kubedb-ops-manager/values.yaml b/charts/kubedb-ops-manager/values.yaml
@@ -125,3 +125,5 @@ recommendationEngine:
   # It also depends on gen-rotate-tls-recommendation-before-expiry-year and gen-rotate-tls-recommendation-before-expiry-month flag.
   # By default it is set as 0(zero).
   genRotateTLSRecommendationBeforeExpiryDay: 0
+psp:
+  enabled: true
diff --git a/charts/kubedb-provisioner/README.md b/charts/kubedb-provisioner/README.md
@@ -80,6 +80,7 @@ The following table lists the configurable parameters of the `kubedb-provisioner
 | monitoring.agent                     | Name of monitoring agent (one of "prometheus.io", "prometheus.io/operator", "prometheus.io/builtin")                                                                                                                                                                                                                                                                            | <code>""</code>                                                                                                                                     |
 | monitoring.serviceMonitor.labels     | Specify the labels for ServiceMonitor. Prometheus crd will select ServiceMonitor using these labels. Only usable when monitoring agent is `prometheus.io/operator`.                                                                                                                                                                                                             | <code>{}</code>                                                                                                                                     |
 | additionalPodSecurityPolicies        | Additional psp names passed to operator <br> Example: <br> `helm template ./chart/kubedb \` <br> `--set additionalPodSecurityPolicies[0]=abc \` <br> `--set additionalPodSecurityPolicies[1]=xyz`                                                                                                                                                                               | <code>[]</code>                                                                                                                                     |
+| psp.enabled                          |                                                                                                                                                                                                                                                                                                                                                                                 | <code>true</code>                                                                                                                                   |
 
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:

diff --git a/charts/kubedb-provisioner/templates/operator-psp.yaml b/charts/kubedb-provisioner/templates/operator-psp.yaml
@@ -1,4 +1,4 @@
-{{ if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }}
+{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/charts/kubedb-provisioner/values.openapiv3_schema.yaml b/charts/kubedb-provisioner/values.openapiv3_schema.yaml
@@ -1175,6 +1175,13 @@ properties:
             type: string
         type: object
     type: object
+  psp:
+    properties:
+      enabled:
+        type: boolean
+    required:
+    - enabled
+    type: object
   registryFQDN:
     type: string
   replicaCount:
@@ -1236,6 +1243,7 @@ required:
 - insecureRegistries
 - monitoring
 - operator
+- psp
 - registryFQDN
 - replicaCount
 - serviceAccount

diff --git a/charts/kubedb-provisioner/values.yaml b/charts/kubedb-provisioner/values.yaml
@@ -115,3 +115,5 @@ monitoring:
 #   --set additionalPodSecurityPolicies[0]=abc \
 #   --set additionalPodSecurityPolicies[1]=xyz
 additionalPodSecurityPolicies: []
+psp:
+  enabled: true
diff --git a/charts/kubedb/values.openapiv3_schema.yaml b/charts/kubedb/values.openapiv3_schema.yaml
@@ -1397,6 +1397,8 @@ properties:
             - allowPrivilegeEscalation
             - privileged
             type: object
+          enabled:
+            type: boolean
           kafka:
             properties:
               allowPrivilegeEscalation:
@@ -1488,6 +1490,7 @@ properties:
             - privileged
             type: object
         required:
+        - enabled
         - kafka
         type: object
       registryFQDN:
@@ -3989,6 +3992,13 @@ properties:
                 type: string
             type: object
         type: object
+      psp:
+        properties:
+          enabled:
+            type: boolean
+        required:
+        - enabled
+        type: object
       recommendationEngine:
         properties:
           genRotateTLSRecommendationBeforeExpiryDay:
@@ -4068,6 +4078,7 @@ properties:
     - insecureRegistries
     - monitoring
     - operator
+    - psp
     - registryFQDN
     - replicaCount
     - serviceAccount
@@ -5286,6 +5297,13 @@ properties:
                 type: string
             type: object
         type: object
+      psp:
+        properties:
+          enabled:
+            type: boolean
+        required:
+        - enabled
+        type: object
       registryFQDN:
         type: string
       replicaCount:
@@ -5349,6 +5367,7 @@ properties:
     - insecureRegistries
     - monitoring
     - operator
+    - psp
     - registryFQDN
     - replicaCount
     - serviceAccount

diff --git a/hack/fmt/templates/psp.yaml b/hack/fmt/templates/psp.yaml
@@ -1,4 +1,4 @@
-{{"{{ if and (.Capabilities.APIVersions.Has \"policy/v1beta1/PodSecurityPolicy\") .Values.catalog."}}{{ .key }}{{" }}"}}
+{{"{{ if and .Values.psp.enabled (.Capabilities.APIVersions.Has \"policy/v1beta1/PodSecurityPolicy\") .Values.catalog."}}{{ .key }}{{" }}"}}
 apiVersion: {{ .object.apiVersion }}
 kind: {{ .object.kind }}
 metadata: