[prometheus-operator-admission-webhook] remove support for psp (#5818)

Signed-off-by: AvivGuiser <avivguiser@gmail.com>
Signed-off-by: Ilia Lazebnik <Ilia.lazebnik@gmail.com>
Signed-off-by: zeritti <47476160+zeritti@users.noreply.github.com>
Co-authored-by: Ilia Lazebnik <Ilia.lazebnik@gmail.com>
Co-authored-by: zeritti <47476160+zeritti@users.noreply.github.com>

Author: 3 people

charts/prometheus-operator-admission-webhook/Chart.yaml

@@ -2,7 +2,7 @@
 apiVersion: v2
 description: Prometheus Operator Admission Webhook
 name: prometheus-operator-admission-webhook
-version: 0.34.0
+version: 0.35.0
 # renovate: github=prometheus-operator/prometheus-operator
 appVersion: 0.88.0
 home: https://github.com/prometheus-operator/prometheus-operator

charts/prometheus-operator-admission-webhook/ci/network-policy-values.yaml

@@ -0,0 +1,6 @@
+---
+networkPolicy:
+  enabled: true
+  labels:
+    foo: bar
+    baz: qux

charts/prometheus-operator-admission-webhook/templates/hooks/clusterrole.yaml

@@ -25,16 +25,4 @@ rules:
       - get
       - update
       - patch
-{{- if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.rbac.pspEnabled }}
-{{- $kubeTargetVersion := default .Capabilities.KubeVersion.Version .Values.kubeVersionOverride }}
-{{- if semverCompare "> 1.15.0-0" $kubeTargetVersion }}
-  - apiGroups: ['policy']
-{{- else }}
-  - apiGroups: ['extensions']
-{{- end }}
-    resources: ['podsecuritypolicies']
-    verbs:     ['use']
-    resourceNames:
-    - {{ include "prometheus-operator-admission-webhook.fullname" . }}-aux
-{{- end }}
 {{- end }}

charts/prometheus-operator-admission-webhook/templates/hooks/psp.yaml

@@ -24,14 +24,4 @@ rules:
     verbs:
       - get
       - create
-{{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
-  - apiGroups:
-      - policy
-    resources:
-      - podsecuritypolicies
-    resourceNames:
-      - {{ include "prometheus-operator-admission-webhook.fullname" . }}-aux
-    verbs:
-      - use
-{{- end }}
 {{- end }}

charts/prometheus-operator-admission-webhook/templates/hooks/role.yaml

@@ -312,17 +312,6 @@
                 }
             }
         },
-        "rbac": {
-            "type": "object",
-            "properties": {
-                "create": {
-                    "type": "boolean"
-                },
-                "pspEnabled": {
-                    "type": "boolean"
-                }
-            }
-        },
         "readinessProbe": {
             "type": "object",
             "properties": {

charts/prometheus-operator-admission-webhook/templates/psp.yaml

@@ -225,11 +225,10 @@ updateStrategy:
     maxSurge: 1
     maxUnavailable: 0
 
-## rbac allows creating roles and pod security policy
-## Ref. https://kubernetes.io/docs/concepts/security/pod-security-policy/
+## rbac allows creating roles
+## Ref. https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
 rbac:
   create: true
-  pspEnabled: false
 
 ## image sets webhook container image parameters
 image:
@@ -338,7 +337,7 @@ prometheusRule:
   labels: {}
     # release: kube-prometheus-stack
   rules: []
-    # - alert: Admission webhook target down
+    # - alert: PrometheusOperatorAdmissionWebhookTargetDown
     #   expr: up{namespace="{{ include "prometheus-operator-admission-webhook.namespace" . }}",
     #       service="{{ include "prometheus-operator-admission-webhook.fullname" . }}"} == 0
     #   for: 5m