Add Instructions to disable PSPs in readme
Problem:
Customers using the latest version of this RKE2 TF module will get the latest version of RKE2, 1.19.x at the time of this writing, and that version deploys PSPs by default and puts them in enforcing mode. (1.18.12+rke2r2, didn't deploy PSPs)
If a user tries to install Big Bang on an RKE2 cluster with PSPs enabled, then OPA Gatekeeper will refuse to deploy (and then nothing else will deploy because it's a logical dependency)
kubectl get replicaset -n=gatekeeper-system
and then describe them and check their events and you'll see they're blocked from deployment by PSP
Big Bang does not support PSPs:
Pod Security Policies "will be remove the API completely at version 1.25" of Kubernetes, due to this fact Big Bang has decided not to support them.
Workaround:
(This was posted on MM, Thanks @runyontr, @Jennifier Power, I'm reposting here to increase discoverability of Consumers of the IaC) (Maybe consider PSP disabled being baked into the default config, so workarounds not needed)
kubectl patch psp system-unrestricted-psp -p '{"metadata": {"annotations":{"seccomp.security.alpha.kubernetes.io/allowedProfileNames": "*"}}}'
kubectl patch psp global-unrestricted-psp -p '{"metadata": {"annotations":{"seccomp.security.alpha.kubernetes.io/allowedProfileNames": "*"}}}'
kubectl patch psp global-restricted-psp -p '{"metadata": {"annotations":{"seccomp.security.alpha.kubernetes.io/allowedProfileNames": "*"}}}'