30c77ea4c1
* Add the option to enable default Pod Security Configuration Enable Pod Security in all namespaces by default with the option to exempt some namespaces. Without the change only namespaces explicitly configured will receive the admission plugin treatment. * Fix the PR according to code review comments * Revert the latest changes - leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file - don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
18 lines
841 B
Django/Jinja
18 lines
841 B
Django/Jinja
{% if kube_pod_security_use_default %}
|
|
apiVersion: pod-security.admission.config.k8s.io/v1beta1
|
|
kind: PodSecurityConfiguration
|
|
defaults:
|
|
enforce: "{{ kube_pod_security_default_enforce }}"
|
|
enforce-version: "{{ kube_pod_security_default_enforce_version }}"
|
|
audit: "{{ kube_pod_security_default_audit }}"
|
|
audit-version: "{{ kube_pod_security_default_audit_version }}"
|
|
warn: "{{ kube_pod_security_default_warn }}"
|
|
warn-version: "{{ kube_pod_security_default_warn_version }}"
|
|
exemptions:
|
|
usernames: {{ kube_pod_security_exemptions_usernames|to_json }}
|
|
runtimeClasses: {{ kube_pod_security_exemptions_runtime_class_names|to_json }}
|
|
namespaces: {{ kube_pod_security_exemptions_namespaces|to_json }}
|
|
{% else %}
|
|
# This file is intentinally left empty as kube_pod_security_use_default={{ kube_pod_security_use_default }}
|
|
{% endif %}
|