Skip to content

Move dynamic PSS baseline patch to apps/profiles/ #3157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
google-oss-prow merged 5 commits into from
Jun 3, 2025
Merged

Move dynamic PSS baseline patch to apps/profiles/ #3157

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
bd67e60
move pss baseline patch to /apps/profiles
akagami-harsh Jun 3, 2025
133e470
revert comments
akagami-harsh Jun 3, 2025
955b6e3
update multi_tenancy_install.sh script
akagami-harsh Jun 3, 2025
8906ee7
add pss baseline to /example/experimental
akagami-harsh Jun 3, 2025
25ae2b2
fix
akagami-harsh Jun 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...y/PSS/dynamic/baseline/kustomization.yaml → apps/profiles/pss/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ kind: Kustomization
namespace: kubeflow

resources:
- ../../../../../apps/profiles/upstream/overlays/kubeflow
- ../upstream/overlays/kubeflow

@juliusvonkohout juliusvonkohout Jun 3, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file must then be used in the /example/kustomization.yaml as well


configMapGenerator:
- name: namespace-labels-data
Expand Down
0 ...SS/dynamic/baseline/namespace-labels.yaml → apps/profiles/pss/namespace-labels.yaml
View file
Open in desktop
File renamed without changes.
4 changes: 2 additions & 2 deletions example/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,15 +42,15 @@
- ../common/istio-cni-1-24/istio-install/overlays/oauth2-proxy
# NOTE: For Google Kubernetes Engine (GKE), use:
# - ../common/istio-cni-1-24/istio-install/overlays/gke
#GKE mounts `/opt/cni/bin` as read-only for security reasons, preventing the Istio CNI installer from writing the CNI binary.

Check warning on line 45 in example/kustomization.yaml

View workflow job for this annotation

GitHub Actions / format_YAML_files 

45:2 [comments] missing starting space in comment
#Use the GKE-specific overlay: `kubectl apply -k common/istio-cni-1-24/istio-install/overlays/gke`.

Check warning on line 46 in example/kustomization.yaml

View workflow job for this annotation

GitHub Actions / format_YAML_files 

46:2 [comments] missing starting space in comment
#This overlay uses GKE's writable CNI directory at `/home/kubernetes/bin`.

Check warning on line 47 in example/kustomization.yaml

View workflow job for this annotation

GitHub Actions / format_YAML_files 

47:2 [comments] missing starting space in comment
#For more details, see [Istio CNI Prerequisites](https://istio.io/latest/docs/setup/additional-setup/cni/#prerequisites) and [Platform Prerequisites](https://istio.io/latest/docs/ambient/install/platform-prerequisites/)

Check warning on line 48 in example/kustomization.yaml

View workflow job for this annotation

GitHub Actions / format_YAML_files 

48:2 [comments] missing starting space in comment
# oauth2-proxy
# NOTE: only uncomment ONE of the following overlays, depending on your cluster type
- ../common/oauth2-proxy/overlays/m2m-dex-only # for all clusters
#- ../common/oauth2-proxy/overlays/m2m-dex-and-kind # for KIND clusters (allows K8S JWTs for gateway auth)

Check warning on line 52 in example/kustomization.yaml

View workflow job for this annotation

GitHub Actions / format_YAML_files 

52:2 [comments] missing starting space in comment
#- ../common/oauth2-proxy/overlays/m2m-dex-and-eks # for EKS clusters (NOTE: requires you to configure issuer, see overlay)

Check warning on line 53 in example/kustomization.yaml

View workflow job for this annotation

GitHub Actions / format_YAML_files 

53:2 [comments] missing starting space in comment
# Dex
- ../common/dex/overlays/oauth2-proxy
# KNative
Expand Down Expand Up @@ -78,8 +78,8 @@
- ../apps/jupyter/jupyter-web-app/upstream/overlays/istio
# Notebook Controller
- ../apps/jupyter/notebook-controller/upstream/overlays/kubeflow
# Profiles + KFAM
- ../apps/profiles/upstream/overlays/kubeflow
# Profiles + KFAM with PSS (Pod Security Standards)
- ../apps/profiles/pss
# PVC Viewer
- ../apps/pvcviewer-controller/upstream/base
# Volumes Web App
Expand Down
5 changes: 2 additions & 3 deletions tests/multi_tenancy_install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
#!/bin/bash
set -euo pipefail

echo "Installing Profiles Controller"
kustomize build apps/profiles/upstream/overlays/kubeflow | kubectl apply -f -
kustomize build experimental/security/PSS/dynamic/baseline | kubectl apply -f -
echo "Installing Profiles Controller with PSS (Pod Security Standards)"
kustomize build apps/profiles/pss | kubectl apply -f -
kubectl -n kubeflow wait --for=condition=Ready pods -l kustomize.component=profiles --timeout 180s

echo "Installing Multitenancy Kubeflow Roles"
Expand Down
Loading