Patch further static namespaces with PSS labels (kubeflow#2768)

* Patched other namespaces in common with PSS labels Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com> * Patched dex and oauth2-proxy namespace with PSS labels Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com> --------- Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com> Signed-off-by: hansinikarunarathne <107214435+hansinikarunarathne@users.noreply.github.com>
hansinikarunarathne · Jul 22, 2024 · f4d8592 · f4d8592
1 parent 1562df7
commit f4d8592
Show file tree

Hide file tree

Showing 8 changed files with 43 additions and 1 deletion.
diff --git a/contrib/security/PSS/static/baseline/kustomization.yaml b/contrib/security/PSS/static/baseline/kustomization.yaml
@@ -4,3 +4,6 @@ kind: Component
 patches:
 - path: patches/kubeflow-labels.yaml
 - path: patches/istio-labels.yaml
+- path: patches/cert-manager-labels.yaml
+- path: patches/dex-labels.yaml
+- path: patches/oauth2-proxy-labels.yaml
diff --git a/contrib/security/PSS/static/baseline/patches/cert-manager-labels.yaml b/contrib/security/PSS/static/baseline/patches/cert-manager-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/baseline/patches/dex-labels.yaml b/contrib/security/PSS/static/baseline/patches/dex-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/baseline/patches/oauth2-proxy-labels.yaml b/contrib/security/PSS/static/baseline/patches/oauth2-proxy-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oauth2-proxy
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
diff --git a/contrib/security/PSS/static/restricted/kustomization.yaml b/contrib/security/PSS/static/restricted/kustomization.yaml
@@ -3,4 +3,7 @@ kind: Component
 
 patches:
 - path: patches/kubeflow-labels.yaml
-- path: patches/istio-labels.yaml
+- path: patches/istio-labels.yaml
+- path: patches/cert-manager-labels.yaml
+- path: patches/dex-labels.yaml
+- path: patches/oauth2-proxy-labels.yaml
diff --git a/contrib/security/PSS/static/restricted/patches/cert-manager-labels.yaml b/contrib/security/PSS/static/restricted/patches/cert-manager-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
diff --git a/contrib/security/PSS/static/restricted/patches/dex-labels.yaml b/contrib/security/PSS/static/restricted/patches/dex-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
diff --git a/contrib/security/PSS/static/restricted/patches/oauth2-proxy-labels.yaml b/contrib/security/PSS/static/restricted/patches/oauth2-proxy-labels.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oauth2-proxy
+  labels:
+    pod-security.kubernetes.io/enforce: restricted