FSAT: Update fabric-operator for compatibility with v1.25.x

This patch updates fabric-operator to utilize PodSecurity Admission controller for Kubernetes v1.25.x. This change is based on the following PR: hyperledger-labs/fabric-operator#82 Signed-off-by: Tatsuya Sato <[email protected]>
hyperledger · Sep 29, 2023 · 83302d9 · 83302d9
1 parent 95c7532
commit 83302d9
Show file tree

Hide file tree

Showing 4 changed files with 3 additions and 57 deletions.
diff --git a/...transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml b/...transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-clusterrole.yaml
@@ -27,14 +27,6 @@ metadata:
     app.kubernetes.io/instance: "ibm-hlfsupport"
     app.kubernetes.io/managed-by: "ibm-hlfsupport-operator"
 rules:
-  - apiGroups:
-      - extensions
-    resourceNames:
-      - ibm-hlfsupport-psp
-    resources:
-      - podsecuritypolicies
-    verbs:
-      - use
   - apiGroups:
       - apiextensions.k8s.io
     resources:

diff --git a/...k-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml b/...k-asset-transfer-guide/infrastructure/sample-network/config/rbac/fabric-operator-psp.yaml
diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml b/full-stack-asset-transfer-guide/infrastructure/sample-network/config/rbac/kustomization.yaml
@@ -19,7 +19,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - fabric-operator-psp.yaml
   - fabric-operator-serviceaccount.yaml
   - fabric-operator-clusterrole.yaml
   - fabric-operator-clusterrolebinding.yaml
diff --git a/full-stack-asset-transfer-guide/infrastructure/sample-network/scripts/sample_network.sh b/full-stack-asset-transfer-guide/infrastructure/sample-network/scripts/sample_network.sh
@@ -60,6 +60,9 @@ metadata:
   name: ${NS}
 EOF
 
+  # https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/
+  kubectl label --overwrite namespace $NS pod-security.kubernetes.io/enforce=baseline
+
   pop_fn
 }