Merge pull request #1045 from jodavis-suse/release-caasp-4.2.0

Backport #1043 - Fix PSP for kubelet disarm job, bsc#1138908
SUSE · Apr 14, 2020 · 7632d9e · 7632d9e
2 parents 7fa7bf7 + 8b18bbd
commit 7632d9e
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 1 deletion.
diff --git a/internal/pkg/skuba/addons/psp.go b/internal/pkg/skuba/addons/psp.go
@@ -119,6 +119,25 @@ subjects:
  name: kube-proxy
  namespace: kube-system
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: kube-disarm
+ namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: suse:caasp:psp:kube-disarm
+roleRef:
+ kind: ClusterRole
+ name: suse:caasp:psp:privileged
+ apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: ServiceAccount
+ name: kube-disarm
+ namespace: kube-system
+---
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

diff --git a/internal/pkg/skuba/kubernetes/kubelet.go b/internal/pkg/skuba/kubernetes/kubelet.go
@@ -98,6 +98,7 @@ func disarmKubeletJobSpec(node *v1.Node, clusterVersion *version.Version) batchv
  return batchv1.JobSpec{
  Template: v1.PodTemplateSpec{
  Spec: v1.PodSpec{
+ ServiceAccountName: "kube-disarm",
  Containers: []v1.Container{
  {
  Name: disarmKubeletJobName(node),

diff --git a/internal/pkg/skuba/kubernetes/versions.go b/internal/pkg/skuba/kubernetes/versions.go
@@ -97,7 +97,7 @@ var (
  Kured: &AddonVersion{"1.3.0", 4},
  Dex: &AddonVersion{"2.16.0", 5},
  Gangway: &AddonVersion{"3.1.0-rev4", 4},
- PSP: &AddonVersion{"", 2},
+ PSP: &AddonVersion{"", 3},
  },
  },
  "1.16.2": KubernetesVersion{