Issues launching debug daemonset in OCP 4.12 related to security constraints about cnf-certification-test HOT 4 CLOSED

@sebrandon1 , as discussed in #548, I think we don't need to change anything in the debug daemonset specification, after testing in OCP 4.12. It's just a matter of adding these two labels to default namespace (where debug daemonset is deployed):

              pod-security.kubernetes.io/enforce: privileged
              pod-security.kubernetes.io/enforce-version: latest

However, as discussed in the PR, I feel that, maybe, it is too extreme to set such privileges in default namespace, which can be used by other workloads, utilities, etc. Having said that, would it be a problem if debug daemonset is deployed in a specific namespace rather than in default namespace? Just to isolate the permissions we give to specific namespaces.

Then, second question I have: can it be included, in the README, this particularity about labelling the namespace where debug daemonset is deployed when working in OCP 4.12? Or should we wait until OCP 4.12 is finally released?

from cnf-certification-test.

@ramperher If I push up a branch, can you point to it and test?

from cnf-certification-test.

@ramperher If I push up a branch, can you point to it and test?

Sure, I can give a try in an OCP 4.12 cluster :) I'll take a look!

from cnf-certification-test.

I believe this change covers the security policies needed for the daemonset:
test-network-function/privileged-daemonset#52

We can close this until we it any more (if any) problems.

from cnf-certification-test.