PodSecurityPolicy deprecated since 1.25

[mrolmedo]

Summary

Hi team,
PodSecurityPolicy API, initially deprecated in Kubernetes v1.21, was entirely removed in Kubernetes v1.25.
In our doc, when listing the capabilities available in Rancher by cluster type: we are still referring to PodSecurityPolicy.
Should be include the support for PSA(Pod Security Admission) too?

[martyav]

Rancher 2.7 and later support PSS, so we should update the files for latest, v2.8, and v2.7 too.

[mrolmedo]

Hi team,
I have another question related to this: PSA/PSP can be managed for EKS-GKE-AKS clusters,

Although, note/step 2 also indicates that the cluster configuration can only be edited for RKE1,RKE2, and K3S clusters.
"Cluster configuration options can't be edited for registered clusters, except for K3s and RKE2 clusters."

So, it is confusing as EKS-AKS-GKE clusters can not be edited, so how can you set up PSA/PSP if the cluster can not be changed/updated?

[martyav]

@jiaqiluo I remember working with you on the PSA/PSP docs. Could you answer this? Thanks!

Although, note/step 2 also indicates that the cluster configuration can only be edited for RKE1,RKE2, and K3S clusters.
"Cluster configuration options can't be edited for registered clusters, except for K3s and RKE2 clusters."
So, it is confusing as EKS-AKS-GKE clusters can not be edited, so how can you set up PSA/PSP if the cluster can not be changed/updated?

[mrolmedo]

Hi team,
I just check the code, for instance, for eks clusters I don´t see PSP available.
Thanks @martyav and @jiaqiluo for your help.

[jiaqiluo]

Hi @mrolmedo ,

1/ To my knowledge, we could not configure the default PSP when creating or editing EKS/GKE/AKS clusters as Rancher does not manage the control plane of the cluster. The prerequisite on the page for adding a PSP mentions the option is available for the rancher-launched RKE clusters. So It seems like an error in our doc.

2/ We couldn't set the default Pod Security Admission (PSA) Configuration Templates when creating EKS/GKE/AKS clusters, but we could set the Pod Security Admission (PSA) ( or Pod Security Standard) on each namespace.