OCPBUGS-61678: fix(kas): Disable PSA enforcement in 4.21

[kevinrizza]

Disable PSA enforcement in 4.21

Related to openshift/api#2623

See #6830 for reference

[openshift-ci-robot]

@kevinrizza: This pull request references Jira Issue OCPBUGS-61678, which is invalid:

• expected the bug to target either version "4.22." or "openshift-4.22.", but it targets "4.21.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Disable PSA enforcement in 4.21

Related to openshift/api#2623

See #6830 for reference

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Modified the default Pod Security Defaults enforcement policy in the KubeAPIServerConfig generation, changing the Enforce value from "restricted" to "privileged". No structural changes or additional behavioral modifications were introduced.

Changes

Cohort / File(s)	Change Summary
Pod Security Defaults Configuration control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go	Changed PodSecurityDefaults.Enforce default value from "restricted" to "privileged" in KubeAPIServerConfig generation

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

• This is a single-file, value-based change with minimal scope
• However, note that this modifies a security-related policy default that may have cluster-wide implications and should be validated for intent and impact

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@kevinrizza: This pull request references Jira Issue OCPBUGS-61678. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

Disable PSA enforcement in 4.21

Related to openshift/api#2623

See #6830 for reference

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kevinrizza
Once this PR has been reviewed and has the lgtm label, please assign devguyio for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment