Deprecation of PodSecurityPolicy in Kubernetes 1.25

[syed-farazahmed]

Hi,

Just wanted to highlight the affect of deprecation of PodSecurityPolicy in Kubernetes version 1.25 on aws-node-termination-handler. The release artefacts provide the all-resources.yaml which has the PodSecurityPolicy defined.

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: aws-node-termination-handler
  labels:
    app.kubernetes.io/name: aws-node-termination-handler
    app.kubernetes.io/instance: aws-node-termination-handler
    app.kubernetes.io/version: "1.19.0"
    app.kubernetes.io/part-of: aws-node-termination-handler
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
spec:
...

When this is applied to any Kubernetes environment having Kubernetes version >= 1.25, we run into the following error:

serviceaccount/aws-node-termination-handler created
clusterrole.rbac.authorization.k8s.io/aws-node-termination-handler created
clusterrolebinding.rbac.authorization.k8s.io/aws-node-termination-handler created
role.rbac.authorization.k8s.io/aws-node-termination-handler-psp created
rolebinding.rbac.authorization.k8s.io/aws-node-termination-handler-psp created
daemonset.apps/aws-node-termination-handler created
daemonset.apps/aws-node-termination-handler-win created
error: resource mapping not found for name: "aws-node-termination-handler" namespace: "" from "https://github.com/aws/aws-node-termination-handler/releases/download/v1.20.0/all-resources.yaml": no matches for kind "PodSecurityPolicy" in version "policy/v1beta1"
ensure CRDs are installed first

Since PodSecurityPolicy is removed in Kubernetes >=1.25, the manifestl is no longer valid.