HNC: Adapt to new PSP replacement

[Yiqi Gao]

See new PSP replacement.

The change is about replacing current PSP, which is not namespaced, with namespace labels such as podsecurity.kubernetes.io/warn=restricted. The PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25.

People will use these new labels to enforce pod security policies per namespace then. Since the label is on namespaces and HNC doesn't propagate labels on a subnamespace, there's no difference of HNC creating a new subnamespace or privileged users creating a new namespace without additional labels. However, users without privileges to create namespaces may not be able to update namespace labels. So we may need to enable them to self-serve namespaces with labels.

[Adrian Ludwin]

I'd remove the bit about pods here since we don't consider this to be a valid use case.

…

On Wed, 14 Apr 2021, 11:33 am Yiqi Gao, ***@***.***> wrote: See new PSP replacement <https://docs.google.com/document/d/1dpfDF3Dk4HhbQe74AyCpzUYMjp4ZhiEgGXSMpVWLlqQ/edit> . The change is about replacing current PSP, which is not namespaced, with namespace labels such as podsecurity.kubernetes.io/warn=restricted. The PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25. This may affect HNC in two aspects: 1. People will use these new labels to enforce pod security policies per namespace then. Since the label is on namespaces and HNC doesn't propagate labels on a subnamespace, there's no difference of HNC creating a new subnamespace or privileged users creating a new namespace without additional labels. However, users without privileges to create namespaces may not be able to update namespace labels. So we may need to enable them to self-serve namespaces with labels. 2. The other thing that may affect HNC is that if users use HNC to propagate pods, some propagation may fail because of the mismatching pod security policy label on the local child namespace. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1473>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE43PZAJK74HKQLKQHYAJQDTIWYU5ANCNFSM425UJKJA> .

[Adrian Ludwin]

Moved to kubernetes-sigs/hierarchical-namespaces#18
/close

[Kubernetes Prow Robot]

@adrianludwin: Closing this issue.

In response to this:

Moved to kubernetes-sigs/hierarchical-namespaces#18
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.