Merge pull request #3529 from mihivagyok/cherry-pick-pr3489-use-restr…

…icted-namespace-v1.35 [Pick #3489] Use restricted namespace for opensource calico-apiserver (v1.35)
tigera · Oct 28, 2024 · 07e78db · 07e78db
2 parents 7982f67 + 9b4951f
commit 07e78db
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/pkg/render/apiserver.go b/pkg/render/apiserver.go
@@ -265,9 +265,13 @@ func (c *apiServerComponent) Objects() ([]client.Object, []client.Object) {
 		namespacedEnterpriseObjects = append(namespacedEnterpriseObjects, c.cfg.TrustedBundle.ConfigMap(QueryserverNamespace))
 	}
 
+	podSecurityNamespaceLabel := PodSecurityStandard(PSSRestricted)
+	if c.hostNetwork() {
+		podSecurityNamespaceLabel = PSSPrivileged
+	}
 	// Global OSS-only objects.
 	globalCalicoObjects := []client.Object{
-		CreateNamespace(rmeta.APIServerNamespace(operatorv1.Calico), c.cfg.Installation.KubernetesProvider, PSSPrivileged),
+		CreateNamespace(rmeta.APIServerNamespace(operatorv1.Calico), c.cfg.Installation.KubernetesProvider, podSecurityNamespaceLabel),
 	}
 
 	// Compile the final arrays based on the variant.