remove default value of catsrc.spec.grpcPodConfig.securityContextConfig #342
Conversation
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
openshift-ci
bot
added
the
approved
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #342 +/- ##
=======================================
Coverage 39.43% 39.43%
=======================================
Files 56 56
Lines 4516 4516
=======================================
Hits 1781 1781
Misses 2581 2581
Partials 154 154 ☔ View full report in Codecov by Sentry. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: acornett21, grokspawn, joelanford The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit 5d2d3fb
into
operator-framework:master
|
|
||
|
|
||
| More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/' | ||
| type: string | ||
| default: legacy |
There was a problem hiding this comment.
Hi, one more question, why not set the default value to restricted? Thanks!
There was a problem hiding this comment.
The new default is "it depends on what the namespace PSA enforcement is", not "restricted, period"
If we changed this to default to restricted in the API, it would be impossible to have an implicit default based on some other condition of the cluster.
In operator-framework/operator-lifecycle-manager#3206, we updated OLM to support an implicit default of a catalog pod's securityContextConfig, based on the PSA configuration of the namespace it is created in.
However, we overlooked the fact that the CatalogSource CRD specifies
legacyas a default value. The result of this is that any catalog source with a non-nilspec.grpcPodConfigthat attempts to leavespec.grpcPodConfig.securityContextConfigunset will be defaulted to legacy during admission.This PR fixes that by removing the default value in the CRD spec.