Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-12689

[Hypershift] hosted clusters default KAS PSA config should be consistent with OCP

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Critical
    • 4.13.0
    • 4.13.0
    • HyperShift
    • None
    • Critical
    • Hypershift Sprint 235
    • 1
    • No
    • Approved
    • False
    • Hide

      None

      Show
      None

    Description

      Description of problem:

      [Hypershift] default KAS PSA config should be consistent with OCP 
       enforce: privileged 

      Version-Release number of selected component (if applicable):

      4.13.0-0.nightly-2023-04-21-084440

      How reproducible:

      Always

      Steps to Reproduce:

      1. Install OCP cluster and hypershift operator
      2. Create hosted cluster
      3. Check the default KAS config of the hosted cluster
      

      Actual results:

      The hosted cluster default KAS PSA config enforce is 'restricted'
      $ jq '.admission.pluginConfig.PodSecurity' < `oc extract cm/kas-config -n clusters-9cb7724d8bdd0c16a113 --confirm`
      {
        "location": "",
        "configuration": {
          "kind": "PodSecurityConfiguration",
          "apiVersion": "pod-security.admission.config.k8s.io/v1beta1",
          "defaults": {
            "enforce": "restricted",
            "enforce-version": "latest",
            "audit": "restricted",
            "audit-version": "latest",
            "warn": "restricted",
            "warn-version": "latest"
          },
          "exemptions": {
            "usernames": [
              "system:serviceaccount:openshift-infra:build-controller"
            ]
          }
        }
      }

      Expected results:

      The hosted cluster default KAS PSA config enforce should be 'privileged' in
      
      https://github.com/openshift/hypershift/blob/release-4.13/control-plane-operator/controllers/hostedcontrolplane/kas/config.go#L93

      Additional info:

      References: OCPBUGS-8710

      Attachments

        Issue Links

          Activity

            People

              rh-ee-brcox Bryan Cox
              rhn-support-pewang Penghao Wang
              Jie Zhao Jie Zhao
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: