From 4d3f6376840b341e981e616d55b36863aa71b0dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=A8=E5=88=9A?= <gang.yang@daocloud.io>
Date: Fri, 28 Oct 2022 12:46:30 +0800
Subject: [PATCH] Remove PodSecurityPolicies in Metallb for kubernetes 1.25
(#9442)
---
.../metallb/templates/metallb.yml.j2 | 78 -------------------
1 file changed, 78 deletions(-)
diff --git a/roles/kubernetes-apps/metallb/templates/metallb.yml.j2 b/roles/kubernetes-apps/metallb/templates/metallb.yml.j2
index 7408625ef..fc03cd286 100644
--- a/roles/kubernetes-apps/metallb/templates/metallb.yml.j2
+++ b/roles/kubernetes-apps/metallb/templates/metallb.yml.j2
@@ -5,84 +5,6 @@ metadata:
labels:
app: metallb
---
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- labels:
- app: metallb
- name: controller
-spec:
- allowPrivilegeEscalation: false
- allowedCapabilities: []
- allowedHostPaths: []
- defaultAddCapabilities: []
- defaultAllowPrivilegeEscalation: false
- fsGroup:
- ranges:
- - max: 65535
- min: 1
- rule: MustRunAs
- hostIPC: false
- hostNetwork: false
- hostPID: false
- privileged: false
- readOnlyRootFilesystem: true
- requiredDropCapabilities:
- - ALL
- runAsUser:
- rule: MustRunAsNonRoot
- seLinux:
- rule: RunAsAny
- supplementalGroups:
- ranges:
- - max: 65535
- min: 1
- rule: MustRunAs
- volumes:
- - configMap
- - secret
- - emptyDir
----
-{% if metallb_speaker_enabled %}
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
- labels:
- app: metallb
- name: speaker
-spec:
- allowPrivilegeEscalation: false
- allowedCapabilities:
- - NET_RAW
- allowedHostPaths: []
- defaultAddCapabilities: []
- defaultAllowPrivilegeEscalation: false
- fsGroup:
- rule: RunAsAny
- hostIPC: false
- hostNetwork: true
- hostPID: false
- hostPorts:
- - max: {{ metallb_port }}
- min: {{ metallb_port }}
- - max: {{ metallb_memberlist_port }}
- min: {{ metallb_memberlist_port }}
- privileged: true
- readOnlyRootFilesystem: true
- requiredDropCapabilities:
- - ALL
- runAsUser:
- rule: RunAsAny
- seLinux:
- rule: RunAsAny
- supplementalGroups:
- rule: RunAsAny
- volumes:
- - configMap
- - secret
- - emptyDir
-{% endif %}
----
apiVersion: v1
kind: ServiceAccount
metadata:
--
GitLab