Remove PodSecurityPolicy in Installer

Author: corneliusludmann

installer/pkg/components/alertmanager/role.go

@@ -6,7 +6,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/gitpod-io/observability/installer/pkg/common"
-	"github.com/gitpod-io/observability/installer/pkg/components/shared"
 )
 
 func role(ctx *common.RenderContext) ([]runtime.Object, error) {
@@ -21,14 +20,7 @@ func role(ctx *common.RenderContext) ([]runtime.Object, error) {
 				Namespace: Namespace,
 				Labels:    common.Labels(Name, Component, App, Version),
 			},
-			Rules: []rbacv1.PolicyRule{
-				{
-					APIGroups:     []string{"policy"},
-					Resources:     []string{"podsecuritypolicies"},
-					Verbs:         []string{"use"},
-					ResourceNames: []string{shared.RestrictedPodsecurityPolicyName()},
-				},
-			},
+			Rules: []rbacv1.PolicyRule{},
 		},
 	}, nil
 }

installer/pkg/components/components.go

@@ -12,7 +12,6 @@ import (
 	"github.com/gitpod-io/observability/installer/pkg/components/prometheus"
 	prometheusoperator "github.com/gitpod-io/observability/installer/pkg/components/prometheus-operator"
 	"github.com/gitpod-io/observability/installer/pkg/components/pyrra"
-	"github.com/gitpod-io/observability/installer/pkg/components/shared"
 	"github.com/gitpod-io/observability/installer/pkg/components/werft"
 )
 
@@ -33,6 +32,5 @@ func MonitoringSatelliteObjects(ctx *common.RenderContext) common.RenderFunc {
 		gitpod.Objects(ctx),
 		certmanager.Objects(ctx),
 		kubernetes.Objects,
-		shared.Objects,
 	)
 }

installer/pkg/components/kubestate-metrics/clusterrole.go

@@ -126,12 +126,6 @@ func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
 					Resources: []string{"subjectaccessreviews"},
 					Verbs:     []string{"create"},
 				},
-				{
-					APIGroups:     []string{"policy"},
-					Resources:     []string{"podsecuritypolicies"},
-					Verbs:         []string{"use"},
-					ResourceNames: []string{Name},
-				},
 			},
 		},
 	}, nil

installer/pkg/components/kubestate-metrics/objects.go

@@ -8,7 +8,6 @@ var Objects = common.CompositeRenderFunc(
 	clusterRole,
 	clusterRoleBinding,
 	deployment,
-	podsecuritypolicy,
 	service,
 	serviceAccount,
 	serviceMonitor,

installer/pkg/components/kubestate-metrics/podsecuritypolicy.go

@@ -30,12 +30,6 @@ func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
 					Resources: []string{"subjectaccessreviews"},
 					Verbs:     []string{"create"},
 				},
-				{
-					APIGroups:     []string{"policy"},
-					Resources:     []string{"podsecuritypolicies"},
-					Verbs:         []string{"use"},
-					ResourceNames: []string{Name},
-				},
 			},
 		},
 	}, nil

installer/pkg/components/node-exporter/clusterrole.go

@@ -8,7 +8,6 @@ var Objects = common.CompositeRenderFunc(
 	clusterRole,
 	clusterRoleBinding,
 	daemonset,
-	podsecuritypolicy,
 	service,
 	serviceAccount,
 	serviceMonitor,

installer/pkg/components/node-exporter/objects.go

@@ -19,14 +19,7 @@ func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
 				Name:   Name,
 				Labels: common.Labels(Name, Component, App, Version),
 			},
-			Rules: []rbacv1.PolicyRule{
-				{
-					APIGroups:     []string{"policy"},
-					Resources:     []string{"podsecuritypolicies"},
-					Verbs:         []string{"use"},
-					ResourceNames: []string{Name},
-				},
-			},
+			Rules: []rbacv1.PolicyRule{},
 		},
 	}, nil
 }

installer/pkg/components/node-exporter/podsecuritypolicy.go

@@ -21,7 +21,6 @@ func Objects(ctx *common.RenderContext) common.RenderFunc {
 			clusterRoleBinding,
 			configMap,
 			deployment,
-			podsecuritypolicy,
 			service,
 			serviceAccount,
 			serviceMonitor,

installer/pkg/components/otel-collector/clusterrole.go

@@ -6,7 +6,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/gitpod-io/observability/installer/pkg/common"
-	"github.com/gitpod-io/observability/installer/pkg/components/shared"
 )
 
 func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
@@ -84,12 +83,12 @@ func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
 					Resources: []string{"subjectaccessreviews"},
 					Verbs:     []string{"create"},
 				},
-				{
-					APIGroups:     []string{"policy"},
-					Resources:     []string{"podsecuritypolicies"},
-					Verbs:         []string{"use"},
-					ResourceNames: []string{shared.RestrictedPodsecurityPolicyName()},
-				},
+				// {
+				// 	APIGroups:     []string{"policy"},
+				// 	Resources:     []string{"podsecuritypolicies"},
+				// 	Verbs:         []string{"use"},
+				// 	ResourceNames: []string{shared.RestrictedPodsecurityPolicyName()},
+				// },
 			},
 		},
 	}, nil

installer/pkg/components/otel-collector/objects.go

@@ -6,7 +6,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/gitpod-io/observability/installer/pkg/common"
-	"github.com/gitpod-io/observability/installer/pkg/components/shared"
 )
 
 func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
@@ -40,12 +39,6 @@ func clusterRole(ctx *common.RenderContext) ([]runtime.Object, error) {
 
 					Verbs: []string{"get"},
 				},
-				{
-					APIGroups:     []string{"policy"},
-					Resources:     []string{"podsecuritypolicies"},
-					Verbs:         []string{"use"},
-					ResourceNames: []string{shared.RestrictedPodsecurityPolicyName()},
-				},
 			},
 		},
 	}, nil