can we use just one template for privileged and unprivileged psp manifests? about caasp-salt

[kiall]

Why? It seems reasonable to separate these, less risk of a change to one affecting the other?

[MaximilianMeister]

Why?

DRY - if you update one, you need to remember to update the other as well because of the duplication

[kiall]

While there are similarities between the two, I'd rather keep this explicit. By looking at the policy, I can see what it does - and what it applies to.

If we add in templating, then it's a lot harder to see at a glance that changes won't accidentally allow unprivileged workloads more permissions than they should have.

[stefsuse]

@MaximilianMeister I agree. I just did a diff of the policies in HEAD and the policies look identical but have different values. At this point it is likely not worth putting in the effort here but in the future design. If this is causing a problem reopen a new issue with the error, thanks.