Added PSS to contrib/baseline and restricted as kustomize components

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>
biswajit-9776 · Jun 21, 2024 · ceaacaf · ceaacaf
1 parent a1dbf47
commit ceaacaf
Show file tree

Hide file tree

Showing 6 changed files with 44 additions and 0 deletions.
diff --git a/contrib/security/PSS/static/baseline/kustomization.yaml b/contrib/security/PSS/static/baseline/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- ../../../../../common/kubeflow-namespace/base
+- ../../../../../common/istio-1-22/istio-namespace/base
+
+patches:
+- path: patches/kubeflow-labels.yaml
+- path: patches/istio-labels.yaml
diff --git a/contrib/security/PSS/static/baseline/patches/istio-labels.yaml b/contrib/security/PSS/static/baseline/patches/istio-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: istio-system
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/baseline/patches/kubeflow-labels.yaml b/contrib/security/PSS/static/baseline/patches/kubeflow-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubeflow
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/restricted/kustomization.yaml b/contrib/security/PSS/static/restricted/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- ../../../../../common/kubeflow-namespace/base
+- ../../../../../common/istio-1-22/istio-namespace/base
+
+patches:
+- path: patches/kubeflow-labels.yaml
+- path: patches/istio-labels.yaml
diff --git a/contrib/security/PSS/static/restricted/patches/istio-labels.yaml b/contrib/security/PSS/static/restricted/patches/istio-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: istio-system
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
diff --git a/contrib/security/PSS/static/restricted/patches/kubeflow-labels.yaml b/contrib/security/PSS/static/restricted/patches/kubeflow-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubeflow
+  labels:
+    pod-security.kubernetes.io/enforce: restricted