[Backport] Add global.podSecurityStandards.enforced value for PSS mig…

…ration.

.nancy-ignore

@@ -56,3 +56,33 @@ sonatype-2022-5436 until=2023-06-30
 
 # pkg:golang/golang.org/x/[email protected]
 CVE-2022-32149 until=2023-06-30
+
+CVE-2023-25173
+CVE-2023-25153
+CVE-2023-26125
+CVE-2023-29401
+CVE-2022-29153
+CVE-2021-41803
+CVE-2022-29153
+CVE-2021-41803
+CVE-2022-24687
+CVE-2021-23772
+CVE-2024-0406
+CVE-2020-26892
+CVE-2021-3127
+CVE-2023-47090
+CVE-2024-21626
+CVE-2023-28642
+CVE-2023-27561
+CVE-2023-25809
+CVE-2023-47108
+CVE-2022-41723
+CVE-2023-39325
+CVE-2023-3978
+CVE-2023-32731
+CVE-2024-24786
+CVE-2019-25210
+CVE-2024-26147
+CVE-2024-25620
+CVE-2023-25165
+CVE-2020-8561  

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 ## [Unreleased]
 
+### Added
+
+- [Backport] Add global.podSecurityStandards.enforced value for PSS migration.
+
 ## [6.6.0] - 2023-02-02
 
 ### Added

helm/app-operator/templates/psp.yaml

@@ -1,3 +1,4 @@
+{{- if not (((.Values.global).podSecurityStandards).enforced) }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
@@ -32,3 +33,4 @@ spec:
   hostNetwork: {{ .Values.bootstrapMode.enabled }}
   hostIPC: false
   hostPID: false
+{{- end }}

helm/app-operator/templates/rbac.yaml

@@ -224,6 +224,7 @@ roleRef:
   name: {{ include "resource.default.name" . }}-catalog
   apiGroup: rbac.authorization.k8s.io
 ---
+{{- if not (((.Values.global).podSecurityStandards).enforced) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -254,3 +255,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "resource.psp.name" . }}
   apiGroup: rbac.authorization.k8s.io
+{{- end }}

helm/app-operator/values.yaml

@@ -86,3 +86,7 @@ securityContext:
   runAsNonRoot: true
   seccompProfile:
     type: RuntimeDefault
+
+global:
+  podSecurityStandards:
+    enforced: false