m/n/k/reconciler: remove PSP role and rolebinding
Pod Security Policies have been removed from Kubernetes. The default PSP
was removed in commit 6211e4dc40, but the role and rolebinding was still
left. They do not have a function anymore. Now that reconciler updates
are implemented, these will be removed from existing clusters after
upgrading.
Change-Id: Ia953a5ae03c581b15efc4e3b3711aaa008dc145d
Reviewed-on: https://review.monogon.dev/c/monogon/+/3091
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/node/kubernetes/controller-manager.go b/metropolis/node/kubernetes/controller-manager.go
index 252de53..71918f9 100644
--- a/metropolis/node/kubernetes/controller-manager.go
+++ b/metropolis/node/kubernetes/controller-manager.go
@@ -77,7 +77,7 @@
pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: config.rootCA})),
args.FileOpt("--client-ca-file", "root-ca.pem",
pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: config.rootCA})),
- "--use-service-account-credentials=true", // Enables things like PSP enforcement
+ "--use-service-account-credentials=true",
fmt.Sprintf("--cluster-cidr=%v", config.clusterNet.String()),
fmt.Sprintf("--service-cluster-ip-range=%v", config.serviceNet.String()),
args.FileOpt("--tls-cert-file", "server-cert.pem",