OCPBUGS-52319: [release-4.18] The openshift-operator-lifecycle-manager namespaces still use old pod-security.kubernetes.io/*-version v1.24 and v1.25 respectively

Makefile

@@ -161,6 +161,16 @@ vendor:
 .PHONY: manifests
 manifests: ## Generate manifests
 	OLM_VERSION=$(OLM_VERSION) ./scripts/generate_crds_manifests.sh
+	$(MAKE) update-k8s-manifests
+
+# Minor Kubernetes version to build against derived from the client-go dependency version
+KUBE_MINOR ?= $(shell go list -m k8s.io/client-go | cut -d" " -f2 | sed 's/^v0\.\([[:digit:]]\{1,\}\)\.[[:digit:]]\{1,\}$$/1.\1/')
+
+.PHONY: update-k8s-manifests # HELP Update pod security versions in manifests with Kubernetes version
+update-k8s-manifests:
+	find manifests microshift-manifests -type f -name '*.yaml' -exec \
+	sed -i.bak -E 's/(pod-security.kubernetes.io\/[a-zA-Z-]+-version:).*/\1 "v$(KUBE_MINOR)"/g' {} +;
+	find manifests microshift-manifests -type f -name '*.yaml.bak' -delete
 
 .PHONY: generate-manifests
 generate-manifests: OLM_VERSION=0.0.1-snapshot

manifests/0000_50_olm_00-namespace.yaml

@@ -4,7 +4,7 @@ metadata:
   name: openshift-operator-lifecycle-manager
   labels:
     pod-security.kubernetes.io/enforce: restricted
-    pod-security.kubernetes.io/enforce-version: "v1.24"
+    pod-security.kubernetes.io/enforce-version: "v1.31"
     openshift.io/scc: ""
     openshift.io/cluster-monitoring: "true"
   annotations:
@@ -21,7 +21,7 @@ metadata:
   name: openshift-operators
   labels:
     pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/enforce-version: "v1.24"
+    pod-security.kubernetes.io/enforce-version: "v1.31"
     openshift.io/scc: ""
   annotations:
     openshift.io/node-selector: ""

microshift-manifests/0000_50_olm_00-namespace.yaml

@@ -4,7 +4,7 @@ metadata:
   name: openshift-operator-lifecycle-manager
   labels:
     pod-security.kubernetes.io/enforce: restricted
-    pod-security.kubernetes.io/enforce-version: "v1.24"
+    pod-security.kubernetes.io/enforce-version: "v1.31"
     openshift.io/scc: ""
     openshift.io/cluster-monitoring: "true"
   annotations:
@@ -21,7 +21,7 @@ metadata:
   name: openshift-operators
   labels:
     pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/enforce-version: "v1.24"
+    pod-security.kubernetes.io/enforce-version: "v1.31"
     openshift.io/scc: ""
   annotations:
     openshift.io/node-selector: ""

staging/operator-lifecycle-manager/Makefile

@@ -263,7 +263,14 @@ e2e-local: e2e-build kind-create deploy e2e
 #SECTION Code Generation
 
 .PHONY: gen-all #HELP Update OLM API, generate code and mocks
-gen-all: manifests codegen mockgen
+gen-all: manifests codegen update-k8s-values mockgen
+
+.PHONY: update-k8s-values #HELP Update Helm Chart values with Kubernetes version
+update-k8s-values:
+	sed -i.bak -E 's/^( *enforceVersion:).*/\1 "v$(KUBE_MINOR)"/' deploy/chart/values.yaml
+	sed -i.bak -E 's/^( *auditVersion:).*/\1 "v$(KUBE_MINOR)"/' deploy/chart/values.yaml
+	sed -i.bak -E 's/^( *warnVersion:).*/\1 "v$(KUBE_MINOR)"/' deploy/chart/values.yaml
+	rm deploy/chart/values.yaml.bak
 
 .PHONY: manifests
 manifests: vendor #HELP Copy OLM API CRD manifests to deploy/chart/crds
@@ -300,8 +307,12 @@ verify-mockgen: mockgen #HELP Check mocks are up to date
 verify-manifests: manifests #HELP Check CRD manifests are up to date
 	$(MAKE) diff
 
+.PHONY: verify-update-k8s-values
+verify-update-k8s-values: update-k8s-values #HELP Check if Helm Chart values are updated with k8s version
+	$(MAKE) diff
+
 .PHONY: verify
-verify: vendor verify-codegen verify-mockgen verify-manifests #HELP Run all verification checks
+verify: vendor verify-codegen verify-mockgen verify-manifests verify-update-k8s-values #HELP Run all verification checks
 	$(MAKE) diff
 
 #SECTION Release

staging/operator-lifecycle-manager/deploy/chart/values.yaml

@@ -3,17 +3,17 @@ namespace: operator-lifecycle-manager
 # see https://kubernetes.io/docs/concepts/security/pod-security-admission/ for more details
 namespace_psa: 
   enforceLevel: baseline
-  enforceVersion: latest
+  enforceVersion: "v1.31"
   auditLevel: restricted
-  auditVersion: latest
+  auditVersion: "v1.31"
   warnLevel: restricted
-  warnVersion: latest
+  warnVersion: "v1.31"
 catalog_namespace: operator-lifecycle-manager
 operator_namespace: operators
 # see https://kubernetes.io/docs/concepts/security/pod-security-admission/ for more details
 operator_namespace_psa: 
   enforceLevel: baseline
-  enforceVersion: latest
+  enforceVersion: "v1.31"
 minKubeVersion: 1.11.0
 writeStatusName: '""'
 imagestream: false