Epic Goal

Why is this important?

It is currently expected that by OCP 4.19 (and current master branch 4-dev-preview) that Pod Security Standard set in OpenShift will be restricted from https://issues.redhat.com/browse/OCPSTRAT-487

Our procedure is the following: * we keep it on on master always

• we disable it in the release branch until 4.19
• with 4.19, we plan to enable it, God willing

Why do we do that?Such that people run into issues and fix them, before we turn it on.

We will need to adjust our products, documentation, and testing accordingly.

Mainly the changes will be related to limiting use of privileged containers across sample apps and the product.

TODOS:

1. Make privileged=true configurable in DPA for node agent. Privileged should be the default, but we need to be able to disable this from the DPA
   1. confirm normal velero manifests backup with CSI/without volumes completes successfully in restricted policy.
2. Document that non-privileged node agent will work for datamover but not fs-backup
3. Document that shallow copy also won't work in restricted pod env
4. Document that to use fs-backup or shallow copy, the cluster security policy must be configured to not require restricted pods
5. modify sample apps to conform to the restricted policy.
6.  set label

   pod-security.kubernetes.io/enforce

Can test restricted Pod Security Standard today in current versions by enabling feature gate or use 4-dev-preview.

• Pod security admission enforcement. Enables the restricted enforcement mode for pod security admission. Instead of only logging a warning, pods are rejected if they violate pod security standards. (OpenShiftPodSecurityAdmission)

Scenarios

Dependencies (internal and external)

User Story:
Foundation for product enhancement.

As a <type of user>
I want <some goal>
so that <value/some reason>

Acceptance Criteria: (Definition of Done)
Defines the scope, what to satisfy before the story is proclaimed as completed. Defines pass/fail criteria.

Verify that…

Functional Acceptance Criteria

Non - Functional Acceptance Criteria