search

kubernetes / pod-security-admission

Kubernetes Pod Security Standards implementation - https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/2579-psp-replacement/README.md
Apache License 2.0
95 stars 27 forks source link

I can't set PSA label on namespace #9

Open JayJay-K opened 1 year ago

JayJay-K commented 1 year ago

I don't know whether I can open issue with this ..

I create one namespace 'psans' with "kuberctl create ns psans". Then, I can see follow labes [root@bastion /]# kubectl describe ns psans | grep secu pod-security.kubernetes.io/audit=baseline pod-security.kubernetes.io/audit-version=v1.24 pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/warn-version=v1.24

And I can add and remove enforce: [root@bastion /]# kubectl label ns psans pod-security.kubernetes.io/enforce=baseline namespace/psans labeled [root@bastion /]# kubectl describe ns psans | grep secu pod-security.kubernetes.io/audit=baseline pod-security.kubernetes.io/audit-version=v1.24 pod-security.kubernetes.io/enforce=baseline pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/warn-version=v1.24 [root@bastion /]# kubectl label ns psans pod-security.kubernetes.io/enforce- namespace/psans unlabeled [root@bastion /]# kubectl describe ns psans | grep secu pod-security.kubernetes.io/audit=baseline pod-security.kubernetes.io/audit-version=v1.24 pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/warn-version=v1.24

But I can't remove audit or warn: [root@bastion /]# kubectl label ns psans pod-security.kubernetes.io/audit-version- namespace/psans unlabeled [root@bastion /]# kubectl describe ns psans | grep secu pod-security.kubernetes.io/audit=baseline pod-security.kubernetes.io/audit-version=v1.24 pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/warn-version=v1.24 [root@bastion /]# kubectl label ns psans pod-security.kubernetes.io/audit- namespace/psans unlabeled [root@bastion /]# kubectl describe ns psans | grep secu pod-security.kubernetes.io/audit=baseline pod-security.kubernetes.io/audit-version=v1.24 pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/warn-version=v1.24

Is it a policy? Otherwise, do I have to use other proper commands?

liggitt commented 12 months ago

does the cluster have an admission webhook that is automatically adding audit/warn labels?

k8s-triage-robot commented 5 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

kundan2707 commented 5 months ago

/remove-lifecycle stale

k8s-triage-robot commented 2 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

kundan2707 commented 1 month ago

/remove-lifecycle rotten

kundan2707 commented 1 month ago

/triage needs-information