feat: add install psa config

pkg/config/config.go

@@ -181,6 +181,10 @@ type Install struct {
 	Harvester               HarvesterChartValues `json:"harvester,omitempty"`
 	RawDiskImagePath        string               `json:"rawDiskImagePath,omitempty"`
 	PersistentPartitionSize string               `json:"persistentPartitionSize,omitempty"`
+
+	// pod security admission config
+	// see templates/rke2-99-harvester-psa.yaml
+	PSA PSAConfig `json:"psaConfig,omitempty"`
 }
 
 type File struct {
@@ -307,6 +311,10 @@ type SSHDConfig struct {
 	SFTP bool `json:"sftp,omitempty"`
 }
 
+type PSAConfig struct {
+	EnforceSecurityLevel string `json:"enforceSecurityLevel"`
+}
+
 type HarvesterConfig struct {
 	// Harvester will use scheme version to determine current version and migrate config to new scheme version
 	SchemeVersion               uint32   `json:"schemeVersion,omitempty"`

pkg/config/cos.go

@@ -420,6 +420,20 @@ func initRancherdStage(config *HarvesterConfig, stage *yipSchema.Stage) error {
 		},
 	)
 
+	rke2KubePSAConfig, err := render("rke2-99-harvester-psa.yaml", config)
+	if err != nil {
+		return err
+	}
+	stage.Files = append(stage.Files,
+		yipSchema.File{
+			Path:        "/etc/rancher/rke2/config.yaml.d/99-harvester-psa.yaml",
+			Content:     rke2KubePSAConfig,
+			Permissions: 0600,
+			Owner:       0,
+			Group:       0,
+		},
+	)
+
 	rke2AgentConfig, err := render("rke2-90-harvester-agent.yaml", config)
 	if err != nil {
 		return err

pkg/config/templates/rke2-90-harvester-server.yaml

@@ -16,3 +16,4 @@ kubelet-arg:
 {{- end }}
 {{- end }}
 audit-policy-file: /etc/rancher/rke2/config.yaml.d/92-harvester-kube-audit-policy.yaml
+pod-security-admission-config-file: /etc/rancher/rke2/config.yaml.d/99-harvester-psa.yaml

pkg/config/templates/rke2-92-harvester-kube-audit-policy.yaml

@@ -2,10 +2,15 @@ apiVersion: audit.k8s.io/v1
 kind: Policy
 omitStages:
   - "ResponseStarted"
-  - "ResponseComplete"
 rules:
   # Any include/exclude rules are added here
 
+  # Log pod changes at RequestResponse level to audit PSA violation
+  - level: RequestResponse
+    resources:
+    - group: ""
+      resources: ["pods"]
+
   # A catch-all rule to log all other (create/delete/patch) requests at the Metadata level
   - level: Metadata
     verbs: ["create", "delete", "patch"]

pkg/config/templates/rke2-99-harvester-psa.yaml

@@ -0,0 +1,58 @@
+apiVersion: apiserver.config.k8s.io/v1
+kind: AdmissionConfiguration
+plugins:
+- name: PodSecurity
+  configuration:
+    apiVersion: pod-security.admission.config.k8s.io/v1
+    kind: PodSecurityConfiguration
+    defaults:
+      enforce: "{{ .Install.PSA.EnforceSecurityLevel }}"
+      enforce-version: "latest"
+      audit: "baseline"
+      audit-version: "latest"
+      warn: "baseline"
+      warn-version: "latest"
+    exemptions:
+      usernames: []
+      runtimeClasses: []
+      namespaces: [calico-apiserver,
+                   calico-system,
+                   cattle-alerting,
+                   cattle-csp-adapter-system,
+                   cattle-elemental-system,
+                   cattle-epinio-system,
+                   cattle-externalip-system,
+                   cattle-fleet-local-system,
+                   cattle-fleet-system,
+                   cattle-gatekeeper-system,
+                   cattle-global-data,
+                   cattle-global-nt,
+                   cattle-impersonation-system,
+                   cattle-istio,
+                   cattle-istio-system,
+                   cattle-logging,
+                   cattle-logging-system,
+                   cattle-monitoring-system,
+                   cattle-neuvector-system,
+                   cattle-prometheus,
+                   cattle-provisioning-capi-system,
+                   cattle-resources-system,
+                   cattle-sriov-system,
+                   cattle-system,
+                   cattle-ui-plugin-system,
+                   cattle-windows-gmsa-system,
+                   cert-manager,
+                   cis-operator-system,
+                   fleet-default,
+                   ingress-nginx,
+                   istio-system,
+                   kube-node-lease,
+                   kube-public,
+                   kube-system,
+                   longhorn-system,
+                   rancher-alerting-drivers,
+                   security-scan,
+                   tigera-operator,
+                   harvester-system,
+                   harvester-public,
+                   rancher-vcluster]

pkg/console/install_panels.go

@@ -2641,6 +2641,10 @@ func addInstallPanel(c *Console) error {
 				c.config.ServerURL = formatted
 			}
 
+			c.config.Install.PSA = config.PSAConfig{
+				EnforceSecurityLevel: "privileged",
+			}
+
 			if !alreadyInstalled {
 				// Have to handle preflight warnings here because we can't check
 				// the NIC speed until we've got the correct set of interfaces.