diff --git a/docs/d_prerequisites.md b/docs/d_prerequisites.md index 64762c69d3dea3f637d3a0fafcebe649e7a3445e..e0cb5efa1df7f433bc1eaeb2776fed231bf9ecc7 100644 --- a/docs/d_prerequisites.md +++ b/docs/d_prerequisites.md @@ -42,4 +42,16 @@ metadata: EOF oc -n logging create -f NetworkAttachmentDefinition.yaml oc -n monitoring create -f NetworkAttachmentDefinition.yaml -``` \ No newline at end of file +``` + +## RKE2 + +### OPA Gatekeeper + +Default PSP configurations for RKE2 prevent OPA Gatekeeper from coming up correctly. See [RKE2 Issue](https://repo1.dso.mil/platform-one/distros/rancher-federal/rke2/rke2-aws-terraform/-/issues/2) and [Big Bang Issue](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/issues/10) Patching the PSPs in the cluster allow OPA Gatekeeper to start correctly: + +```bash +kubectl patch psp system-unrestricted-psp -p '{"metadata": {"annotations":{"seccomp.security.alpha.kubernetes.io/allowedProfileNames": "*"}}}' +kubectl patch psp global-unrestricted-psp -p '{"metadata": {"annotations":{"seccomp.security.alpha.kubernetes.io/allowedProfileNames": "*"}}}' +kubectl patch psp global-restricted-psp -p '{"metadata": {"annotations":{"seccomp.security.alpha.kubernetes.io/allowedProfileNames": "*"}}}' +```