Skip to content

Commit 3d1bae2

Browse files
mriduljimridulji
authored
removing deprecated psp (#1540)
1 parent 7070f05 commit 3d1bae2

File tree

5 files changed

+5
-233
lines changed

5 files changed

+5
-233
lines changed

‎Makefile

+3-5
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,6 @@ build/chart/: build/chart/index.yaml build/chart/index.yaml.$(YEAR_MONTH_DAY)
318318

319319
install-chart-prerequisite: build/toolchain/bin/kubectl$(EXE_EXTENSION) update-chart-deps
320320
-$(KUBECTL) create namespace $(OPEN_MATCH_KUBERNETES_NAMESPACE)
321-
$(KUBECTL) apply -f install/gke-metadata-server-workaround.yaml
322321

323322
# Used for Open Match development. Install om-configmap-override.yaml by default.
324323
HELM_UPGRADE_FLAGS = --cleanup-on-fail -i --no-hooks --debug --timeout=600s --namespace=$(OPEN_MATCH_KUBERNETES_NAMESPACE) --set global.gcpProjectId=$(GCP_PROJECT_ID) --set open-match-override.enabled=true --set redis.password=$(REDIS_DEV_PASSWORD) --set redis.auth.enabled=false --set redis.auth.sentinel=false
@@ -389,8 +388,8 @@ install-ci-chart: install-chart-prerequisite build/toolchain/bin/helm$(EXE_EXTEN
389388
delete-chart: build/toolchain/bin/helm$(EXE_EXTENSION) build/toolchain/bin/kubectl$(EXE_EXTENSION)
390389
-$(HELM) uninstall $(OPEN_MATCH_HELM_NAME)
391390
-$(HELM) uninstall $(OPEN_MATCH_HELM_NAME)-demo
392-
-$(KUBECTL) delete psp,clusterrole,clusterrolebinding --selector=release=open-match
393-
-$(KUBECTL) delete psp,clusterrole,clusterrolebinding --selector=release=open-match-demo
391+
-$(KUBECTL) delete clusterrole,clusterrolebinding --selector=release=open-match
392+
-$(KUBECTL) delete clusterrole,clusterrolebinding --selector=release=open-match-demo
394393
-$(KUBECTL) delete namespace $(OPEN_MATCH_KUBERNETES_NAMESPACE)
395394
-$(KUBECTL) delete namespace $(OPEN_MATCH_KUBERNETES_NAMESPACE)-demo
396395

@@ -641,7 +640,7 @@ delete-kind-cluster: build/toolchain/bin/kind$(EXE_EXTENSION) build/toolchain/bi
641640
create-cluster-role-binding:
642641
$(KUBECTL) create clusterrolebinding myname-cluster-admin-binding --clusterrole=cluster-admin --user=$(GCLOUD_ACCOUNT_EMAIL)
643642

644-
create-gke-cluster: GKE_VERSION = 1.22.12-gke.2300 # gcloud beta container get-server-config --zone us-west1-a
643+
create-gke-cluster: GKE_VERSION = 1.25.5-gke.2000 # gcloud beta container get-server-config --zone us-west1-a
645644
create-gke-cluster: GKE_CLUSTER_SHAPE_FLAGS = --machine-type n1-standard-8 --enable-autoscaling --min-nodes 1 --num-nodes 6 --max-nodes 10 --disk-size 50
646645
create-gke-cluster: GKE_FUTURE_COMPAT_FLAGS = --no-enable-basic-auth --no-issue-client-certificate --enable-ip-alias --metadata disable-legacy-endpoints=true --enable-autoupgrade
647646
create-gke-cluster: build/toolchain/bin/kubectl$(EXE_EXTENSION) gcloud
@@ -650,7 +649,6 @@ create-gke-cluster: build/toolchain/bin/kubectl$(EXE_EXTENSION) gcloud
650649
--image-type cos_containerd \
651650
--tags open-match \
652651
--workload-pool $(GCP_PROJECT_ID).svc.id.goog
653-
$(MAKE) create-cluster-role-binding
654652

655653

656654
delete-gke-cluster: gcloud

‎install/helm/open-match/templates/podsecuritypolicy.yaml

-140
This file was deleted.

‎install/helm/open-match/templates/service-account.yaml

+2-75
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ metadata:
2323
labels:
2424
app: {{ template "openmatch.name" . }}
2525
release: {{ .Release.Name }}
26+
pod-security.kubernetes.io/enforce: baseline
27+
pod-security.kubernetes.io/warn: baseline
2628
{{- end }}
2729
---
2830
# Create a universal service account for open-match-core services.
@@ -39,79 +41,4 @@ metadata:
3941
release: {{ .Release.Name }}
4042
automountServiceAccountToken: true
4143
---
42-
kind: Role
43-
apiVersion: rbac.authorization.k8s.io/v1
44-
metadata:
45-
name: {{ include "openmatch.fullname" . }}-service-role
46-
namespace: {{ .Release.Namespace }}
47-
annotations: {{- include "openmatch.chartmeta" . | nindent 4 }}
48-
labels:
49-
app: {{ template "openmatch.name" . }}
50-
release: {{ .Release.Name }}
51-
rules:
52-
- apiGroups:
53-
- extensions
54-
resources:
55-
- podsecuritypolicies
56-
resourceNames:
57-
- {{ include "openmatch.fullname" . }}-core-podsecuritypolicy
58-
verbs:
59-
- use
60-
---
61-
kind: RoleBinding
62-
apiVersion: rbac.authorization.k8s.io/v1
63-
metadata:
64-
name: {{ include "openmatch.fullname" . }}-service-role-binding
65-
namespace: {{ .Release.Namespace }}
66-
annotations: {{- include "openmatch.chartmeta" . | nindent 4 }}
67-
labels:
68-
app: {{ template "openmatch.name" . }}
69-
release: {{ .Release.Name }}
70-
subjects:
71-
- kind: Group
72-
name: system:authenticated # All authenticated users
73-
apiGroup: rbac.authorization.k8s.io
74-
roleRef:
75-
kind: Role
76-
name: {{ include "openmatch.fullname" . }}-service-role
77-
apiGroup: rbac.authorization.k8s.io
78-
---
79-
{{- if index .Values "open-match-core" "redis" "enabled" }}
80-
kind: Role
81-
apiVersion: rbac.authorization.k8s.io/v1
82-
metadata:
83-
name: {{ include "openmatch.fullname" . }}-redis-role
84-
namespace: {{ .Release.Namespace }}
85-
annotations: {{- include "openmatch.chartmeta" . | nindent 4 }}
86-
labels:
87-
app: {{ template "openmatch.name" . }}
88-
release: {{ .Release.Name }}
89-
rules:
90-
- apiGroups:
91-
- extensions
92-
resources:
93-
- podsecuritypolicies
94-
resourceNames:
95-
- {{ include "openmatch.fullname" . }}-redis-podsecuritypolicy
96-
verbs:
97-
- use
98-
---
99-
kind: RoleBinding
100-
apiVersion: rbac.authorization.k8s.io/v1
101-
metadata:
102-
name: {{ include "openmatch.fullname" . }}-redis-role-binding
103-
namespace: {{ .Release.Namespace }}
104-
annotations: {{- include "openmatch.chartmeta" . | nindent 4 }}
105-
labels:
106-
app: {{ template "openmatch.name" . }}
107-
release: {{ .Release.Name }}
108-
subjects:
109-
- kind: ServiceAccount
110-
name: {{ include "call-nested" (list . "redis" "redis.serviceAccountName") }}
111-
namespace: {{ .Release.Namespace }}
112-
roleRef:
113-
kind: Role
114-
name: {{ include "openmatch.fullname" . }}-redis-role
115-
apiGroup: rbac.authorization.k8s.io
116-
{{- end }}
11744
{{- end }}

‎install/helm/open-match/templates/tests/om-test-role.yaml

-8
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,6 @@ metadata:
2424
app: {{ template "openmatch.name" . }}
2525
release: {{ .Release.Name }}
2626
rules:
27-
- apiGroups:
28-
- extensions
29-
resources:
30-
- podsecuritypolicies
31-
resourceNames:
32-
- {{ include "openmatch.fullname" . }}-core-podsecuritypolicy
33-
verbs:
34-
- use
3527
# Grant this role get & list permission for k8s endpoints and pods resources
3628
# Required for e2e in-cluster testing.
3729
- apiGroups:

‎install/terraform/open-match-build/open-match-build.tf

-5
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,6 @@ resource "google_container_cluster" "ci_cluster" {
9696
identity_namespace = "${var.gcp_project_id}.svc.id.goog"
9797
}
9898

99-
# Enable PodSecurityPolicy
100-
pod_security_policy_config {
101-
enabled = "true"
102-
}
103-
10499
node_config {
105100
oauth_scopes = [
106101
"https://www.googleapis.com/auth/devstorage.read_only",

0 commit comments

Comments
 (0)