From f5187ff1dfafd1c1fd55e980624e178ae6d68aab Mon Sep 17 00:00:00 2001
From: Simon Gerber <simon.gerber@vshn.ch>
Date: Fri, 3 Jul 2026 13:54:02 +0200
Subject: [PATCH] Add Pod Security Admission labels on namespace

We set the PSA labels with value `privileged` on the namespace to allow
the CSI controller and daemonset to be admitted on clusters that enforce
Pod Security Standards.

In order to simplify the implementation, we also unconditionally set the
`openshift.io/node-selector` annotation, which doesn't break anything on
non-OpenShift.
---
 component/main.jsonnet                                   | 9 +++++++--
 docs/modules/ROOT/pages/references/parameters.adoc       | 2 ++
 .../csi-cloudscale/csi-cloudscale/00_namespace.yaml      | 6 +++++-
 .../csi-cloudscale/csi-cloudscale/00_namespace.yaml      | 3 +++
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/component/main.jsonnet b/component/main.jsonnet
index 4c6da88..9407968 100644
--- a/component/main.jsonnet
+++ b/component/main.jsonnet
@@ -70,13 +70,18 @@ local warnDeprecatedParam(o) =
     o;
 
 {
-  [if params.namespace != 'kube-system' then '00_namespace']: kube.Namespace(params.namespace) + if isOpenshift then {
+  [if params.namespace != 'kube-system' then '00_namespace']: kube.Namespace(params.namespace) {
     metadata+: {
       annotations+: {
         'openshift.io/node-selector': '',
       },
+      labels+: {
+        'pod-security.kubernetes.io/audit': 'privileged',
+        'pod-security.kubernetes.io/enforce': 'privileged',
+        'pod-security.kubernetes.io/warn': 'privileged',
+      },
     },
-  } else {},
+  },
   '01_storageclasses': std.flattenArrays(storageclasses),
   '02_secret': warnDeprecatedParam(secret),
   [if std.length(customRBAC) > 0 then '30_custom_rbac']: customRBAC,
diff --git a/docs/modules/ROOT/pages/references/parameters.adoc b/docs/modules/ROOT/pages/references/parameters.adoc
index 2e7e855..9ab1088 100644
--- a/docs/modules/ROOT/pages/references/parameters.adoc
+++ b/docs/modules/ROOT/pages/references/parameters.adoc
@@ -14,6 +14,8 @@ In K8s prior to 1.17, the driver won't run in namespaces other than `kube-system
 This is because the priority class `system-cluster-critical` is only available to pods in namespace `kube-system`.
 See https://kubernetes.io/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default[the Kubernetes priority class consumption] documentation for instructions on how to allow the driver to run in a namespace other than `kube-system`.
 
+NOTE: The component will set the https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces[Pod Security Admission] labels on the namespace to `privileged` to allow the CSI driver pods (which require capability `SYS_ADMIN`) to run.
+
 == `images`
 
 [horizontal]
diff --git a/tests/golden/defaults/csi-cloudscale/csi-cloudscale/00_namespace.yaml b/tests/golden/defaults/csi-cloudscale/csi-cloudscale/00_namespace.yaml
index 4a7db94..f8d9c62 100644
--- a/tests/golden/defaults/csi-cloudscale/csi-cloudscale/00_namespace.yaml
+++ b/tests/golden/defaults/csi-cloudscale/csi-cloudscale/00_namespace.yaml
@@ -1,7 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations: {}
+  annotations:
+    openshift.io/node-selector: ''
   labels:
     name: syn-csi-cloudscale
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
   name: syn-csi-cloudscale
diff --git a/tests/golden/openshift4/csi-cloudscale/csi-cloudscale/00_namespace.yaml b/tests/golden/openshift4/csi-cloudscale/csi-cloudscale/00_namespace.yaml
index 5eecbcc..f8d9c62 100644
--- a/tests/golden/openshift4/csi-cloudscale/csi-cloudscale/00_namespace.yaml
+++ b/tests/golden/openshift4/csi-cloudscale/csi-cloudscale/00_namespace.yaml
@@ -5,4 +5,7 @@ metadata:
     openshift.io/node-selector: ''
   labels:
     name: syn-csi-cloudscale
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
   name: syn-csi-cloudscale