Add namespace for Supportability Review for PSA namespace exemption

Resolves #2025.

Supportability Review pods require the “runAsNonRoot=false” permission, so
enabling PSA causes them to fail to start. To fix this, we need to add the
`sr-operator-system` namespace to the exemption list.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
This commit is contained in:
Masashi Honma
2025-10-15 09:23:13 +09:00
parent 492e5cec9e
commit 0a47ac603c
5 changed files with 5 additions and 0 deletions
@@ -126,6 +126,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `longhorn-system`
- `rancher-alerting-drivers`
- `security-scan`
- `sr-operator-system`
- `tigera-operator`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
@@ -129,6 +129,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `longhorn-system`
- `rancher-alerting-drivers`
- `security-scan`
- `sr-operator-system`
- `tigera-operator`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
@@ -129,6 +129,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `longhorn-system`
- `rancher-alerting-drivers`
- `security-scan`
- `sr-operator-system`
- `tigera-operator`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
@@ -126,6 +126,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `longhorn-system`
- `rancher-alerting-drivers`
- `security-scan`
- `sr-operator-system`
- `tigera-operator`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
@@ -128,6 +128,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `longhorn-system`
- `rancher-alerting-drivers`
- `security-scan`
- `sr-operator-system`
- `tigera-operator`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).