Add Pod Security Admission labels on namespace

component/main.jsonnet

@@ -70,13 +70,18 @@ local warnDeprecatedParam(o) =
     o;
 
 {
-  [if params.namespace != 'kube-system' then '00_namespace']: kube.Namespace(params.namespace) + if isOpenshift then {
+  [if params.namespace != 'kube-system' then '00_namespace']: kube.Namespace(params.namespace) {
     metadata+: {
       annotations+: {
         'openshift.io/node-selector': '',
       },
+      labels+: {
+        'pod-security.kubernetes.io/audit': 'privileged',
+        'pod-security.kubernetes.io/enforce': 'privileged',
+        'pod-security.kubernetes.io/warn': 'privileged',
+      },
     },
-  } else {},
+  },
   '01_storageclasses': std.flattenArrays(storageclasses),
   '02_secret': warnDeprecatedParam(secret),
   [if std.length(customRBAC) > 0 then '30_custom_rbac']: customRBAC,

docs/modules/ROOT/pages/references/parameters.adoc

@@ -14,6 +14,8 @@ In K8s prior to 1.17, the driver won't run in namespaces other than `kube-system
 This is because the priority class `system-cluster-critical` is only available to pods in namespace `kube-system`.
 See https://kubernetes.io/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default[the Kubernetes priority class consumption] documentation for instructions on how to allow the driver to run in a namespace other than `kube-system`.
 
+NOTE: The component will set the https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces[Pod Security Admission] labels on the namespace to `privileged` to allow the CSI driver pods (which require capability `SYS_ADMIN`) to run.
+
 == `images`
 
 [horizontal]

tests/golden/defaults/csi-cloudscale/csi-cloudscale/00_namespace.yaml

@@ -1,7 +1,11 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations: {}
+  annotations:
+    openshift.io/node-selector: ''
   labels:
     name: syn-csi-cloudscale
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
   name: syn-csi-cloudscale

tests/golden/openshift4/csi-cloudscale/csi-cloudscale/00_namespace.yaml

@@ -5,4 +5,7 @@ metadata:
     openshift.io/node-selector: ''
   labels:
     name: syn-csi-cloudscale
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged
   name: syn-csi-cloudscale