Skip to content

Migrate from PodSecurityPolicy to Pod Security Admission #638

@snay2

Description

@snay2

Describe the bug
When running the end-to-end tests on Kubernetes server version 1.23, I get the following warning:

policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+

Steps to reproduce
Run the following command on your local machine from the root of the repo:

test/k8s-local-cluster-test/run-test -v 1.23 -d

Then wait for it to build the image and start the cluster. After the first test starts running (e.g., "Running assertion script asg-lifecycle-sqs-test"), you'll see the warning above.

Expected outcome
We need to add support for Pod Security Admission before we can support Kubernetes server 1.25 (expected release date August 2022). However, if we wish to maintain support for the most recent 6 Kubernetes versions (which would include 1.20 and 1.21 at that time), we will need to keep the existing PodSecurityPolicy specs or use a third-party solution, because support for built-in Pod Security Admission began in 1.22.

The migration guide is here: https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/

PodSecurityPolicy is used in several places throughout the repository: https://github.com/aws/aws-node-termination-handler/search?q=PodSecurityPolicy

Application Logs
See above.

Environment

  • NTH App Version: 1.16.3
  • NTH Mode (IMDS/Queue processor): N/A
  • OS/Arch: MacOS 12.3.1
  • Kubernetes version: 1.23
  • Installation method: Source code

Metadata

Metadata

Assignees

Labels

Priority: MediumThis issue will be seen by about half of usersstalebot-ignoreTo NOT let the stalebot update or close the Issue / PR

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions