diff --git a/CHANGELOG.md b/CHANGELOG.md index 0fb39395..235ec806 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added + +- Add `global.podSecurityStandards.enforced` value for PSS migration. + ### Changed - Remove SecretReconciler. diff --git a/helm/capa-iam-operator/templates/psp.yaml b/helm/capa-iam-operator/templates/psp.yaml index f66d34a3..dcd152a3 100644 --- a/helm/capa-iam-operator/templates/psp.yaml +++ b/helm/capa-iam-operator/templates/psp.yaml @@ -1,4 +1,4 @@ -{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }} +{{- if not .Values.global.podSecurityStandards.enforced }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: diff --git a/helm/capa-iam-operator/values.schema.json b/helm/capa-iam-operator/values.schema.json index 25e881fe..eec4758a 100644 --- a/helm/capa-iam-operator/values.schema.json +++ b/helm/capa-iam-operator/values.schema.json @@ -126,6 +126,19 @@ "type": "boolean" } } + }, + "global": { + "type": "object", + "properties": { + "podSecurityStandards": { + "type": "object", + "properties": { + "enforced": { + "type": "boolean" + } + } + } + } } } } diff --git a/helm/capa-iam-operator/values.yaml b/helm/capa-iam-operator/values.yaml index 23dade07..4794c696 100644 --- a/helm/capa-iam-operator/values.yaml +++ b/helm/capa-iam-operator/values.yaml @@ -38,3 +38,7 @@ securityContext: capabilities: drop: - ALL + +global: + podSecurityStandards: + enforced: false