feat: remove PSP

BREAKING CHANGE: PSP are removed by default preparing for depreciation Signed-off-by: Kevin Lefevre <[email protected]>
particuleio · Jun 14, 2022 · e6ac1d7 · e6ac1d7
1 parent 885778b
commit e6ac1d7
Show file tree

Hide file tree

Showing 14 changed files with 5 additions and 34 deletions.
diff --git a/cert-manager.tf b/cert-manager.tf
@@ -22,9 +22,6 @@ locals {
 
   values_cert-manager = <<VALUES
 global:
-  podSecurityPolicy:
-    enabled: true
-    useAppArmor: false
   priorityClassName: ${local.priority-class["create"] ? kubernetes_priority_class.kubernetes_addons[0].metadata[0].name : ""}
 serviceAccount:
   name: ${local.cert-manager["service_account_name"]}

diff --git a/flux.tf b/flux.tf
@@ -18,7 +18,6 @@ locals {
   values_flux = <<VALUES
 rbac:
   create: true
-  pspEnabled: false
 syncGarbageCollection:
   enabled: true
   dry: false

diff --git a/ingress-nginx.tf b/ingress-nginx.tf
@@ -28,8 +28,6 @@ controller:
   publishService:
     enabled: true
   priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
-podSecurityPolicy:
-  enabled: false
   admissionWebhooks:
     patch:
       podAnnotations:

diff --git a/kong.tf b/kong.tf
@@ -30,8 +30,6 @@ env:
   database: "off"
 admin:
   type: ClusterIP
-podSecurityPolicy:
-  enabled: true
 autoscaling:
   enabled: true
 replicaCount: 2

diff --git a/kube-prometheus.tf b/kube-prometheus.tf
@@ -19,7 +19,7 @@ locals {
   values_kube-prometheus-stack = <<VALUES
 grafana:
   rbac:
-    pspUseAppArmor: false
+    pspEnabled: false
   adminPassword: ${join(",", random_string.grafana_password.*.result)}
   dashboardProviders:
     dashboardproviders.yaml:

diff --git a/modules/aws/cert-manager.tf b/modules/aws/cert-manager.tf
@@ -26,9 +26,6 @@ locals {
 
   values_cert-manager = <<VALUES
 global:
-  podSecurityPolicy:
-    enabled: true
-    useAppArmor: false
   priorityClassName: ${local.priority-class["create"] ? kubernetes_priority_class.kubernetes_addons[0].metadata[0].name : ""}
 serviceAccount:
   name: ${local.cert-manager["service_account_name"]}

diff --git a/modules/aws/cluster-autoscaler.tf b/modules/aws/cluster-autoscaler.tf
@@ -25,7 +25,6 @@ autoDiscovery:
 awsRegion: ${data.aws_region.current.name}
 rbac:
   create: true
-  pspEnabled: true
   serviceAccount:
     name: ${local.cluster-autoscaler["service_account_name"]}
     annotations:

diff --git a/modules/aws/ingress-nginx.tf b/modules/aws/ingress-nginx.tf
@@ -37,8 +37,6 @@ controller:
   config:
     use-proxy-protocol: "true"
   priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
-podSecurityPolicy:
-  enabled: true
   admissionWebhooks:
     patch:
       podAnnotations:
@@ -63,8 +61,6 @@ controller:
   publishService:
     enabled: true
   priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
-podSecurityPolicy:
-  enabled: true
   admissionWebhooks:
     patch:
       podAnnotations:
@@ -89,8 +85,6 @@ controller:
   publishService:
     enabled: true
   priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
-podSecurityPolicy:
-  enabled: true
   admissionWebhooks:
     patch:
       podAnnotations:
@@ -122,8 +116,6 @@ controller:
     use-forwarded-headers: "true"
     proxy-real-ip-cidr: "0.0.0.0/0"
   priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
-podSecurityPolicy:
-  enabled: true
   admissionWebhooks:
     patch:
       podAnnotations:

diff --git a/modules/aws/kube-prometheus.tf b/modules/aws/kube-prometheus.tf
@@ -44,7 +44,7 @@ grafana:
         global:
           enabled: ${local.kube-prometheus-stack["thanos_sidecar_enabled"] ? "true" : "false"}
   rbac:
-    pspUseAppArmor: false
+    pspEnabled: false
   serviceAccount:
     create: true
     name: ${local.kube-prometheus-stack["grafana_service_account_name"]}

diff --git a/modules/scaleway/cert-manager.tf b/modules/scaleway/cert-manager.tf
@@ -36,9 +36,6 @@ locals {
 
   values_cert-manager = <<VALUES
 global:
-  podSecurityPolicy:
-    enabled: true
-    useAppArmor: false
   priorityClassName: ${local.priority-class["create"] ? kubernetes_priority_class.kubernetes_addons[0].metadata[0].name : ""}
 serviceAccount:
   name: ${local.cert-manager["service_account_name"]}

diff --git a/modules/scaleway/ingress-nginx.tf b/modules/scaleway/ingress-nginx.tf
@@ -34,14 +34,12 @@ controller:
   config:
     use-proxy-protocol: "true"
   priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
-defaultBackend:
-  replicaCount: 2
-podSecurityPolicy:
-  enabled: false
   admissionWebhooks:
     patch:
       podAnnotations:
         linkerd.io/inject: disabled
+defaultBackend:
+  replicaCount: 2
 VALUES
 
 }

diff --git a/modules/scaleway/kube-prometheus.tf b/modules/scaleway/kube-prometheus.tf
@@ -37,7 +37,7 @@ grafana:
         global:
           enabled: ${local.kube-prometheus-stack["thanos_sidecar_enabled"] ? "true" : "false"}
   rbac:
-    pspUseAppArmor: false
+    pspEnabled: false
   adminPassword: ${join(",", random_string.grafana_password.*.result)}
   dashboardProviders:
     dashboardproviders.yaml:

diff --git a/node-problem-detector.tf b/node-problem-detector.tf
@@ -14,8 +14,6 @@ locals {
   )
 
   values_npd = <<VALUES
-rbac:
-  pspEnabled: true
 priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
 VALUES
 

diff --git a/sealed-secrets.tf b/sealed-secrets.tf
@@ -15,8 +15,6 @@ locals {
   )
 
   values_sealed-secrets = <<VALUES
-rbac:
-  pspEnabled: true
 priorityClassName: ${local.priority-class["create"] ? kubernetes_priority_class.kubernetes_addons[0].metadata[0].name : ""}
 VALUES
-Original file line number
+Diff line change
@@ Expand Up / @@ -14,8 +14,6 @@ locals { @@
       )
       values_npd = <<VALUES
-    rbac:
-      pspEnabled: true
     priorityClassName: ${local.priority-class-ds["create"] ? kubernetes_priority_class.kubernetes_addons_ds[0].metadata[0].name : ""}
     VALUES
@@ Expand Down @@