Skip to content

Commit 4219fb9

Browse files
joelanfordci-robot
joelanford
authored and
ci-robot
committed
remove default value of catsrc.spec.grpcPodConfig.securityContextConfig (#342)
Signed-off-by: Joe Lanford <[email protected]> Upstream-repository: api Upstream-commit: 5d2d3fbe061b7b4a942747877efa58958fa9889e
1 parent 37a7668 commit 4219fb9

File tree

8 files changed

+32
-54
lines changed

8 files changed

+32
-54
lines changed

‎manifests/0000_50_olm_00-catalogsources.crd.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1027,19 +1027,15 @@ spec:
10271027
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10281028
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10291029
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1030-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1031-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1032-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1033-
set to `legacy`.
1034-
1035-
1036-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1037-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1030+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1031+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1032+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1033+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1034+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10381035
10391036
10401037
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10411038
type: string
1042-
default: legacy
10431039
enum:
10441040
- legacy
10451041
- restricted

‎microshift-manifests/0000_50_olm_00-catalogsources.crd.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1027,19 +1027,15 @@ spec:
10271027
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10281028
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10291029
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1030-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1031-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1032-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1033-
set to `legacy`.
1034-
1035-
1036-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1037-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1030+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1031+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1032+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1033+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1034+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10381035
10391036
10401037
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10411038
type: string
1042-
default: legacy
10431039
enum:
10441040
- legacy
10451041
- restricted

‎staging/api/crds/operators.coreos.com_catalogsources.yaml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1023,19 +1023,15 @@ spec:
10231023
SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
10241024
right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
10251025
Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
1026-
run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
1027-
value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
1028-
When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
1029-
set to `legacy`.
1030-
1031-
1032-
In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
1033-
with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
1026+
run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
1027+
determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
1028+
will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
1029+
specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
1030+
catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
10341031
10351032
10361033
More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
10371034
type: string
1038-
default: legacy
10391035
enum:
10401036
- legacy
10411037
- restricted

‎staging/api/crds/zz_defs.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎staging/api/pkg/operators/v1alpha1/catalogsource_types.go

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -133,18 +133,15 @@ type GrpcPodConfig struct {
133133
// SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the
134134
// right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod
135135
// Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be
136-
// run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default
137-
// value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error.
138-
// When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be
139-
// set to `legacy`.
140-
//
141-
// In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs
142-
// with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes.
136+
// run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be
137+
// determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod
138+
// will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was
139+
// specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older
140+
// catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`.
143141
//
144142
// More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'
145143
// +optional
146144
// +kubebuilder:validation:Enum=legacy;restricted
147-
// +kubebuilder:default:=legacy
148145
SecurityContextConfig SecurityConfig `json:"securityContextConfig,omitempty"`
149146

150147
// MemoryTarget configures the $GOMEMLIMIT value for the gRPC catalog Pod. This is a soft memory limit for the server,

‎vendor/github.com/operator-framework/api/crds/operators.coreos.com_catalogsources.yaml

Lines changed: 5 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/operator-framework/api/crds/zz_defs.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/operator-framework/api/pkg/operators/v1alpha1/catalogsource_types.go

Lines changed: 5 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)