Propagate global.podSecurityStandards.enforced value set to false…

… for PSS migration
giantswarm · Sep 28, 2023 · 39370a1 · 39370a1
1 parent 732dac2
commit 39370a1
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Propagate `global.podSecurityStandards.enforced` value set to `false` for PSS migration
+
 ## [0.5.0] - 2023-09-21
 
 ### Added

diff --git a/helm/teleport-kube-agent/templates/psp.yaml b/helm/teleport-kube-agent/templates/psp.yaml
@@ -2,7 +2,7 @@
   We must remove them before 1.25 to ensure the Helm state doesn't corrupt. As this is a breaking change, this
   only applies to v12+ charts. v11 and below will only show a warning from the NOTES.txt.
   Users must use PSAs instead (beta in 1.23, GA in 1.25). The "teleport-cluster" chart runs in "baseline" mode */}}
-{{- if and .Values.podSecurityPolicy.enabled (semverCompare "<1.25.0" .Capabilities.KubeVersion.Version) -}}
+{{- if and (not .Values.global.podSecurityStandards.enforced) .Values.podSecurityPolicy.enabled (semverCompare "<1.25.0" .Capabilities.KubeVersion.Version) -}}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/helm/teleport-kube-agent/values.yaml b/helm/teleport-kube-agent/values.yaml
@@ -2,6 +2,10 @@
 # Values that must always be provided by the user.
 ################################################################
 
+global:
+  podSecurityStandards:
+    enforced: false
+
 # Join token for the cluster. `joinParams` can also pass the join token,
 # but supports more join methods and takes precedence if set.
 authToken: ""