From 0a47ac603c8498ba6396c6255ba60cafacecf32e Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Wed, 15 Oct 2025 09:23:13 +0900 Subject: [PATCH] Add namespace for Supportability Review for PSA namespace exemption MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves #2025. Supportability Review pods require the “runAsNonRoot=false” permission, so enabling PSA causes them to fail to start. To fix this, we need to add the `sr-operator-system` namespace to the exemption list. Signed-off-by: Masashi Honma --- .../psa-config-templates.md | 1 + .../psa-config-templates.md | 1 + .../psa-config-templates.md | 1 + .../psa-config-templates.md | 1 + .../psa-config-templates.md | 1 + 5 files changed, 5 insertions(+) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index d6d2942afd2..e924a4cfffa 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -126,6 +126,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `longhorn-system` - `rancher-alerting-drivers` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 0ea24911d5a..862083d9fa7 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -129,6 +129,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `longhorn-system` - `rancher-alerting-drivers` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 0ea24911d5a..862083d9fa7 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -129,6 +129,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `longhorn-system` - `rancher-alerting-drivers` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index d6d2942afd2..e924a4cfffa 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -126,6 +126,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `longhorn-system` - `rancher-alerting-drivers` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 67949dbbff4..dd1d9f60c21 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -128,6 +128,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `longhorn-system` - `rancher-alerting-drivers` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).