Skip to content

Commit fb1d56f

Browse files
mtesseractmtesseract
committed
Invert logic for generating PSPs: Mak them opt-in instead of opt-out and adjust CI
1 parent 3b51eed commit fb1d56f

File tree

12 files changed

+46
-44
lines changed

12 files changed

+46
-44
lines changed

‎.circleci/config.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2519,7 +2519,7 @@ jobs:
25192519
- LOCAL_PORT: 8000
25202520
- COLLECTION_METHOD: ebpf
25212521
- GCP_IMAGE_TYPE: "COS"
2522-
- POD_SECURITY_POLICIES: "true"
2522+
- POD_SECURITY_POLICIES: "false"
25232523
- MONITORING_SUPPORT: false
25242524
- SCANNER_SUPPORT: true
25252525
- ROX_BASELINE_GENERATION_DURATION: 1m
@@ -2936,7 +2936,7 @@ jobs:
29362936
resource_class: small
29372937
environment:
29382938
- GCP_IMAGE_TYPE: "COS"
2939-
- POD_SECURITY_POLICIES: "true"
2939+
- POD_SECURITY_POLICIES: "false"
29402940
steps:
29412941
- checkout
29422942
- check-backend-changes
@@ -2946,27 +2946,27 @@ jobs:
29462946
- provision-gke-cluster:
29472947
cluster-id: api-e2e-tests
29482948

2949-
provision-gke-api-e2e-tests-no-psps:
2949+
provision-gke-api-e2e-tests-with-psps:
29502950
executor: custom
29512951
resource_class: small
29522952
environment:
29532953
- GCP_IMAGE_TYPE: "COS"
2954-
- POD_SECURITY_POLICIES: "false"
2954+
- POD_SECURITY_POLICIES: "true"
29552955
steps:
29562956
- checkout
29572957
- check-backend-changes
29582958
- check-label-to-skip-tests:
29592959
label: ci-no-qa-tests
29602960

29612961
- provision-gke-cluster:
2962-
cluster-id: api-e2e-tests-no-psps
2962+
cluster-id: api-e2e-tests-with-psps
29632963

29642964
provision-gke-postgres-api-e2e-tests:
29652965
executor: custom
29662966
resource_class: small
29672967
environment:
29682968
- GCP_IMAGE_TYPE: "COS"
2969-
- POD_SECURITY_POLICIES: "true"
2969+
- POD_SECURITY_POLICIES: "false"
29702970
steps:
29712971
- checkout
29722972
- check-backend-changes
@@ -3345,7 +3345,7 @@ jobs:
33453345
resource_class: small
33463346
environment:
33473347
GCP_IMAGE_TYPE: "COS"
3348-
POD_SECURITY_POLICIES: "true"
3348+
POD_SECURITY_POLICIES: "false"
33493349
steps:
33503350
- checkout
33513351
- check-backend-changes
@@ -3626,7 +3626,7 @@ jobs:
36263626
- check-label-to-skip-tests:
36273627
label: ci-no-qa-tests
36283628

3629-
gke-api-e2e-tests-no-psps:
3629+
gke-api-e2e-tests-with-psps:
36303630
executor: custom
36313631
environment:
36323632
- LOCAL_PORT: 443
@@ -3640,17 +3640,17 @@ jobs:
36403640
- ADMISSION_CONTROLLER_UPDATES: true
36413641
- ROX_NETWORK_BASELINE_OBSERVATION_PERIOD: 2m
36423642
- ROX_NEW_POLICY_CATEGORIES: true
3643-
- POD_SECURITY_POLICIES: false
3643+
- POD_SECURITY_POLICIES: true
36443644

36453645
steps:
36463646
- run-qa-tests:
3647-
cluster-id: api-e2e-tests-no-psps
3647+
cluster-id: api-e2e-tests-with-psps
36483648
sensor-deploy-flavor: helm
36493649
determine-whether-to-run:
36503650
- check-label-to-skip-tests:
36513651
label: ci-no-qa-tests
36523652
- run-qa-tests:
3653-
cluster-id: api-e2e-tests-no-psps
3653+
cluster-id: api-e2e-tests-with-psps
36543654
sensor-deploy-flavor: kubectl
36553655
determine-whether-to-run:
36563656
- check-label-to-skip-tests:
@@ -4889,15 +4889,15 @@ workflows:
48894889
- build-rhacs
48904890
- build-scale-monitoring-and-mock-server
48914891
- provision-gke-api-e2e-tests
4892-
- provision-gke-api-e2e-tests-no-psps:
4892+
- provision-gke-api-e2e-tests-with-psps:
48934893
<<: *runOnAllTagsWithQuayIOPullCtx
4894-
- gke-api-e2e-tests-no-psps:
4894+
- gke-api-e2e-tests-with-psps:
48954895
<<: *runOnAllTagsWithQuayIOPullCtx
48964896
requires:
48974897
- build-stackrox
48984898
- build-rhacs
48994899
- build-scale-monitoring-and-mock-server
4900-
- provision-gke-api-e2e-tests-no-psps
4900+
- provision-gke-api-e2e-tests-with-psps
49014901
- provision-gke-postgres-api-e2e-tests:
49024902
<<: *runOnAllTagsWithQuayIOPullCtx
49034903
- gke-postgres-api-e2e-tests:

‎central/clusters/deployer.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,6 @@ func getBaseMetaValues(c *storage.Cluster, versions version.Versions, opts *Rend
179179
AdmissionControlEnforceOnUpdates: c.GetDynamicConfig().GetAdmissionControllerConfig().GetEnforceOnUpdates(),
180180
ReleaseBuild: buildinfo.ReleaseBuild,
181181

182-
EnableDeprecatedPodSecurityPolicies: true,
182+
EnableDeprecatedPodSecurityPolicies: false,
183183
}
184184
}

‎deploy/common/k8sbased.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,8 @@ function launch_central {
188188
add_args "--with-config-file=${ROXDEPLOY_CONFIG_FILE_MAP}"
189189
fi
190190

191-
if [[ "$POD_SECURITY_POLICIES" == "false" ]]; then
192-
add_args "--enable-deprecated-pod-security-policies=false"
191+
if [[ "$POD_SECURITY_POLICIES" == "true" ]]; then
192+
add_args "--enable-deprecated-pod-security-policies"
193193
fi
194194

195195
local unzip_dir="${k8s_dir}/central-deploy/"
@@ -290,9 +290,9 @@ function launch_central {
290290
)
291291
fi
292292

293-
if [[ "$POD_SECURITY_POLICIES" == "false" ]]; then
293+
if [[ "$POD_SECURITY_POLICIES" == "true" ]]; then
294294
helm_args+=(
295-
--set system.enableDeprecatedPodSecurityPolicies=false
295+
--set system.enableDeprecatedPodSecurityPolicies=true
296296
)
297297
fi
298298

‎pkg/helm/charts/meta.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func GetMetaValuesForFlavor(imageFlavor defaults.ImageFlavor) *MetaValues {
8383
ReleaseBuild: buildinfo.ReleaseBuild,
8484
FeatureFlags: getFeatureFlags(),
8585

86-
EnableDeprecatedPodSecurityPolicies: true,
86+
EnableDeprecatedPodSecurityPolicies: false,
8787
}
8888

8989
return &metaValues

‎pkg/helm/charts/tests/centralservices/base_suite_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@ scanner:
7575
cert: "scanner-db tls cert pem"
7676
key: "scanner-db tls key pem"
7777
enableOpenShiftMonitoring: true
78+
system:
79+
enableDeprecatedPodSecurityPolicies: true
7880
`
7981
autogenerateAll = `
8082
licenseKey: "my license key"
@@ -98,6 +100,8 @@ central:
98100
enabled: true
99101
enableCentralDB: true
100102
enableOpenShiftMonitoring: true
103+
system:
104+
enableDeprecatedPodSecurityPolicies: true
101105
`
102106
)
103107

‎pkg/helm/charts/tests/centralservices/testdata/helmtest/central.test.yaml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ values:
1212
tests:
1313
- name: "central with default settings"
1414
expect: |
15-
.podsecuritypolicys["stackrox-central"] | assertThat(. != null)
16-
.rolebindings["stackrox-central-psp"] | assertThat(. != null)
17-
.clusterroles["stackrox-central-psp"] | assertThat(. != null)
1815
.serviceaccounts["central"] | assertThat(. != null)
1916
.secrets["central-htpasswd"].stringData.htpasswd | assertThat(length != 0)
2017
.configmaps["central-config"].data.["central-config.yaml"] | assertThat(length != 0)
@@ -26,11 +23,11 @@ tests:
2623
- name: "central with deprecated PodSecurityPolicies disabled"
2724
values:
2825
system:
29-
enableDeprecatedPodSecurityPolicies: false
26+
enableDeprecatedPodSecurityPolicies: true
3027
expect: |
31-
.podsecuritypolicys["stackrox-central"] | assertThat(. == null)
32-
.rolebindings["stackrox-central-psp"] | assertThat(. == null)
33-
.clusterroles["stackrox-central-psp"] | assertThat(. == null)
28+
.podsecuritypolicys["stackrox-central"] | assertThat(. != null)
29+
.rolebindings["stackrox-central-psp"] | assertThat(. != null)
30+
.clusterroles["stackrox-central-psp"] | assertThat(. != null)
3431
3532
- name: "central with OpenShift 3 and enabled SCCs"
3633
server:

‎pkg/helm/charts/tests/centralservices/testdata/helmtest/scanner.test.yaml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ values:
1212
tests:
1313
- name: "scanner with default settings"
1414
expect: |
15-
.podsecuritypolicys["stackrox-scanner"] | assertThat(. != null)
16-
.rolebindings["stackrox-scanner-psp"] | assertThat(. != null)
17-
.clusterroles["stackrox-scanner-psp"] | assertThat(. != null)
1815
.serviceaccounts["scanner"] | assertThat(. != null)
1916
.secrets["scanner-db-password"].stringData.password | assertThat(length != 0)
2017
.configmaps["scanner-config"].data.["config.yaml"] | assertThat(length != 0)
@@ -42,11 +39,11 @@ tests:
4239
- name: "scanner with deprecated PodSecurityPolicies disabled"
4340
values:
4441
system:
45-
enableDeprecatedPodSecurityPolicies: false
42+
enableDeprecatedPodSecurityPolicies: true
4643
expect: |
47-
.podsecuritypolicys["stackrox-scanner"] | assertThat(. == null)
48-
.rolebindings["stackrox-scanner-psp"] | assertThat(. == null)
49-
.clusterroles["stackrox-scanner-psp"] | assertThat(. == null)
44+
.podsecuritypolicys["stackrox-scanner"] | assertThat(. != null)
45+
.rolebindings["stackrox-scanner-psp"] | assertThat(. != null)
46+
.clusterroles["stackrox-scanner-psp"] | assertThat(. != null)
5047
5148
#TODO: Add istio tests
5249
- name: "configured scanner"

‎pkg/helm/charts/tests/securedclusterservices/base_suite_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,9 @@ config:
9494
enableOpenShiftMonitoring: true
9595
scanner:
9696
disable: false
97+
98+
system:
99+
enableDeprecatedPodSecurityPolicies: true
97100
`
98101
)
99102

‎roxctl/central/generate/generate.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ func Command(cliEnvironment environment.Environment) *cobra.Command {
308308
if !buildinfo.ReleaseBuild {
309309
flags.AddHelmChartDebugSetting(c)
310310
}
311-
c.PersistentFlags().BoolVar(&centralGenerateCmd.rendererConfig.EnableDeprecatedPodSecurityPolicies, "enable-deprecated-pod-security-policies", true, "Generate deprecated PodSecurityPolicy resources")
311+
c.PersistentFlags().BoolVar(&centralGenerateCmd.rendererConfig.EnableDeprecatedPodSecurityPolicies, "enable-deprecated-pod-security-policies", false, "Generate deprecated PodSecurityPolicy resources")
312312

313313
c.AddCommand(centralGenerateCmd.interactive())
314314
c.AddCommand(k8s(cliEnvironment))

‎roxctl/scanner/generate/generate.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func Command(cliEnvironment environment.Environment) *cobra.Command {
109109
fmt.Sprintf(
110110
"Generate deployment files supporting the given Istio version. Valid versions: %s",
111111
strings.Join(istioutils.ListKnownIstioVersions(), ", ")))
112-
c.PersistentFlags().BoolVar(&scannerGenerateCmd.enableDeprecatedPodSecurityPolicies, "enable-deprecated-pod-security-policies", true, "Generate deprecated PodSecurityPolicy resources")
112+
c.PersistentFlags().BoolVar(&scannerGenerateCmd.enableDeprecatedPodSecurityPolicies, "enable-deprecated-pod-security-policies", false, "Generate deprecated PodSecurityPolicy resources")
113113

114114
return c
115115
}

0 commit comments

Comments
 (0)