[Backport] Add global.podSecurityStandards.enforced value for PSS mig…

…ration.

.nancy-ignore

@@ -29,3 +29,28 @@ CVE-2023-25165 until=2023-11-30
 
 # pkg:golang/k8s.io/[email protected]
 CVE-2020-8561 until=2023-11-30
+
+CVE-2023-29401
+CVE-2022-29153
+CVE-2022-29153
+CVE-2021-41803
+CVE-2022-24687
+CVE-2021-23772
+CVE-2024-0406
+CVE-2020-26892
+CVE-2021-3127
+CVE-2023-47090
+CVE-2024-21626
+CVE-2023-28642
+CVE-2023-27561
+CVE-2023-25809
+CVE-2023-47108
+CVE-2023-48795
+CVE-2023-39325
+CVE-2023-3978
+CVE-2024-24786
+CVE-2019-25210
+CVE-2024-26147
+CVE-2024-25620
+CVE-2023-25165
+CVE-2020-8561

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 ## [Unreleased]
 
+### Added
+
+- [Backport] Add global.podSecurityStandards.enforced value for PSS migration.
+
 ## [6.8.1] - 2023-09-14
 
 ### Fixed

helm/app-operator/templates/psp.yaml

@@ -1,4 +1,4 @@
-{{- if .Capabilities.APIVersions.Has "policy/v1beta1" }}
+{{- if not (((.Values.global).podSecurityStandards).enforced) }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

helm/app-operator/templates/rbac.yaml

@@ -224,6 +224,7 @@ roleRef:
   name: {{ include "resource.default.name" . }}-catalog
   apiGroup: rbac.authorization.k8s.io
 ---
+{{- if not (((.Values.global).podSecurityStandards).enforced) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -254,3 +255,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "resource.psp.name" . }}
   apiGroup: rbac.authorization.k8s.io
+{{- end }}

helm/app-operator/values.schema.json

@@ -86,6 +86,19 @@
                 }
             }
         },
+        "global": {
+            "type": "object",
+            "properties": {
+                "podSecurityStandards": {
+                    "type": "object",
+                    "properties": {
+                        "enforced": {
+                            "type": "boolean"
+                        }
+                    }
+                }
+            }
+        },
         "groupID": {
             "type": "integer"
         },

helm/app-operator/values.yaml

@@ -93,3 +93,7 @@ serviceMonitor:
   interval: "60s"
   # -- (duration) Prometheus scrape timeout.
   scrapeTimeout: "45s"
+
+global:
+  podSecurityStandards:
+    enforced: false

pkg/project/project.go

@@ -5,7 +5,7 @@ var (
 	gitSHA      = "n/a"
 	name        = "app-operator"
 	source      = "https://github.com/giantswarm/app-operator"
-	version     = "6.8.1"
+	//version     = "6.8.1"
 )
 
 func Description() string {
@@ -31,5 +31,5 @@ func Source() string {
 }
 
 func Version() string {
-	return version
+	return "6.8.1"
 }