Merge PSS_baseline and PSS_restricted

.github/workflows/dex_oauth2-proxy_test.yaml

@@ -53,6 +53,9 @@ jobs:
     - name: Create KF Profile
       run: ./tests/kubeflow_profile_install.sh
 
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh
+
     - name: Port forward the istio-ingress gateway
       run: ./tests/port_forward_gateway.sh
 
@@ -65,18 +68,3 @@ jobs:
         python3 tests/dex_login_test.py
 
         echo "Dex login test completed successfully."
-
-    - name: Apply Pod Security Standards baseline levels for static namespaces
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels for static namespaces
-      run: ./tests/PSS_restricted_enable.sh

.github/workflows/full_kubeflow_integration_test.yaml

@@ -63,7 +63,7 @@
     - name: Install KServe
       run: ./tests/kserve_install.sh
 
     #- name: Install Pipelines
     #  run: ./tests/pipelines_install.sh
 
     - name: Install Pipelines with SeaweedFS
@@ -252,18 +252,8 @@
           exit 1
         fi
 
-    - name: Apply Pod Security Standards Baseline
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Remove Pod Security Labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow" "knative-serving")
-        for namespace in "${NAMESPACES[@]}"; do
-            kubectl label namespace $namespace pod-security.kubernetes.io/enforce-
-        done
-
     - name: Apply Pod Security Standards Restricted
-      run: ./tests/PSS_restricted_enable.sh
+      run: ./tests/PSS_enable.sh restricted
 
     - name: Verify Components
       run: kubectl get pods --all-namespaces | grep -E '(Error|CrashLoopBackOff)' && exit 1 || true

.github/workflows/istio_validation.yaml

@@ -190,9 +190,9 @@ jobs:
         kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE -- \
           wget -qO- --timeout=10 test-application.$KF_PROFILE.svc.cluster.local
 
-    - name: Apply Pod Security Standards baseline levels
+    - name: Apply Pod Security Standards Restricted levels
       if: matrix.istio-mode == 'cni'
-      run: ./tests/PSS_baseline_enable.sh
+      run: ./tests/PSS_enable.sh
 
     - name: Collect debug information on failure
       if: failure()

.github/workflows/katib_test.yaml

@@ -82,17 +82,5 @@ jobs:
         UNAUTHORIZED_TOKEN=$(kubectl -n test-unauthorized create token test-unauthorized)
         kubectl get experiments.kubeflow.org -n $KF_PROFILE --token="$UNAUTHORIZED_TOKEN" >/dev/null
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

.github/workflows/kserve_jwt_authentication_test.yaml

@@ -84,5 +84,5 @@ jobs:
         fi
 
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

.github/workflows/kserve_secure_test.yaml

@@ -79,5 +79,5 @@ jobs:
     - name: Run KServe secure authentication tests
       run: ./tests/kserve_jwt_authentication_test.sh kubeflow-user-example-com
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

.github/workflows/kserve_test.yaml

@@ -91,17 +91,5 @@ jobs:
       run: |
         kubectl wait --for=condition=Available --timeout=300s -n kubeflow deployment/kserve-models-web-app
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow" "knative-serving")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

.github/workflows/pipeline_run_from_notebook.yaml

@@ -77,17 +77,5 @@ jobs:
         kubectl -n kubeflow-user-example-com exec -ti \
           test-0 -- python /home/jovyan/pipeline_run_and_wait_kubeflow.py
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow" "knative-serving")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

.github/workflows/pipeline_swfs_test.yaml

@@ -114,20 +114,8 @@ jobs:
     - name: Test SeaweedFS Namespace Isolation
       run: ./tests/swfs_namespace_isolation_test.sh
 
-    - name: Apply Pod Security Standards baseline levels for static namespaces
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels for static namespaces
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh
 
     - name: Collect Logs on Failure
       if: failure()

.github/workflows/pipeline_test.yaml

@@ -95,17 +95,5 @@ jobs:
         python3 tests/pipeline_v2_test.py test_unauthorized_access "${TOKEN}" "${KF_PROFILE}"
         echo "Test succeeded. Token from unauthorized ServiceAccount cannot list pipelines in $KF_PROFILE namespace."
 
-    - name: Apply Pod Security Standards baseline levels for static namespaces
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels for static namespaces
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

.github/workflows/trainer_test.yaml

@@ -82,20 +82,8 @@ jobs:
         UNAUTHORIZED_TOKEN=$(kubectl -n test-unauthorized create token test-unauthorized)
         kubectl get trainjobs -n $KF_PROFILE --token="$UNAUTHORIZED_TOKEN" >/dev/null
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow" "kubeflow-system")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh
 
     - name: Collect Logs on Failure
       if: failure()

.github/workflows/training_operator_test.yaml

@@ -81,17 +81,5 @@ jobs:
         UNAUTHORIZED_TOKEN=$(kubectl -n test-unauthorized create token test-unauthorized)
         kubectl get pytorchjobs -n $KF_PROFILE --token="$UNAUTHORIZED_TOKEN" >/dev/null
 
-    - name: Apply Pod Security Standards baseline levels
-      run: ./tests/PSS_baseline_enable.sh
-
-    - name: Unapply applied baseline labels
-      run: |
-        NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
-        for NAMESPACE in "${NAMESPACES[@]}"; do
-          if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
-            kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
-          fi
-        done
-
-    - name: Applying Pod Security Standards restricted levels
-      run: ./tests/PSS_restricted_enable.sh
+    - name: Apply Pod Security Standards restricted levels
+      run: ./tests/PSS_enable.sh

tests/PSS_enable.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+set -euo pipefail
+
+PSS_LEVEL="${1:-restricted}"
+
+[[ "$PSS_LEVEL" == "baseline" || "$PSS_LEVEL" == "restricted" ]] || {
+    echo "ERROR: Invalid PSS level '$PSS_LEVEL'. Usage: $0 [baseline|restricted]"
+    exit 1
+}
+
+NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow" "knative-serving" "kubeflow-system")
+[[ "$PSS_LEVEL" == "baseline" ]] && NAMESPACES+=("kubeflow-user-example-com")
+
+echo "Applying PSS $PSS_LEVEL to: ${NAMESPACES[*]}"
+
+for NAMESPACE in "${NAMESPACES[@]}"; do
+    if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
+        continue
+    fi
+
+    PATCH_OUTPUT=$(kubectl label namespace "$NAMESPACE" "pod-security.kubernetes.io/enforce=$PSS_LEVEL" --overwrite 2>&1)
+    if echo "$PATCH_OUTPUT" | grep -q "violate the new PodSecurity"; then
+        echo "ERROR: PSS violation in namespace $NAMESPACE"
+        echo "$PATCH_OUTPUT" | grep -A 5 "violate the new PodSecurity"
+        exit 1
+    fi
+    echo "✅ $NAMESPACE"
+done