panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add recommendation for namespacePSS (#131)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-12-21 00:15:56 +00:00
committed by GitHub
co-authored by Marco Franssen
parent 0555c87eef
commit c39dd44526
5 changed files with 45 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/templates/spire-server-namespace.yaml
+21 -5
View File
@@ -1,14 +1,30 @@
{{- if .Values.global.spire.namespaces.server.create }}
{{- define "spire.namespace.default_server_labels" }}
"pod-security.kubernetes.io/warn": restricted
"pod-security.kubernetes.io/audit": restricted
"pod-security.kubernetes.io/enforce": restricted
{{- end }}
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.server.create }}
{{- $labels := dict }}
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
{{- $labels = mergeOverwrite $labels (include "spire.namespace.default_server_labels" . | fromYaml) }}
{{- if (dig "openshift" false .Values.global) }}
{{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
{{- if (index .Values "spiffe-oidc-discovery-provider").enabled }}
{{- $_ := set $labels "pod-security.kubernetes.io/enforce" "privileged" }}
{{- end }}
{{- end }}
{{- end }}
{{- $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
apiVersion: v1
kind: Namespace
metadata:
name: {{ .Values.global.spire.namespaces.server.name }}
{{- if .Values.global.spire.namespaces.server.labels }}
{{- with $labels }}
labels:
{{- .Values.global.spire.namespaces.server.labels | toYaml | nindent 4 }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if .Values.global.spire.namespaces.server.annotations }}
{{- with .Values.global.spire.namespaces.server.annotations }}
annotations:
{{- .Values.global.spire.namespaces.server.annotations | toYaml | nindent 4 }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/templates/spire-system-namespace.yaml
+18 -5
View File
@@ -1,14 +1,27 @@
{{- if .Values.global.spire.namespaces.system.create }}
{{- define "spire.namespace.default_system_labels" }}
"pod-security.kubernetes.io/warn": privileged
"pod-security.kubernetes.io/audit": privileged
"pod-security.kubernetes.io/enforce": privileged
{{- end }}
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.system.create }}
{{- $labels := dict }}
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
{{- $labels = mergeOverwrite $labels (include "spire.namespace.default_system_labels" . | fromYaml) }}
{{- if (dig "openshift" false .Values.global) }}
{{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
{{- end }}
{{- end }}
{{- $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
apiVersion: v1
kind: Namespace
metadata:
name: {{ .Values.global.spire.namespaces.system.name }}
{{- if .Values.global.spire.namespaces.system.labels }}
{{- with $labels }}
labels:
{{- .Values.global.spire.namespaces.system.labels | toYaml | nindent 4 }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if .Values.global.spire.namespaces.system.annotations }}
{{- with .Values.global.spire.namespaces.system.annotations }}
annotations:
{{- .Values.global.spire.namespaces.system.annotations | toYaml | nindent 4 }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}