Disable PSP on RKE2 1.24 (v1.24.9+rke2r2) with cis-1.6 Issue

[mitchellmaler]

Hello, We are working on upgrading one older cluster from 1.24 to 1.25 and were trying to disable PSP to take care of some cleanup before it is completely removed. However, when we try to disable the PodSecurityPolicy disable-admission-plugins=PodSecurityPolicy it keeps being added back.
Is there any way to disable it without the defaults being added back to the string, that way the API server can start without it throwing an error about overlapping enable and disable admission controllers?
Thanks

[mitchellmaler]

We tried adding enable-admission-plugins=NodeRestriction which omits PodSecurityPolicy, but it keeps getting added back to the arg.

[dereknola]

You cannot turn off the PodSecurityPolicy in RKE2, it is always on by default. When you reach that section in the Upstream Documentation, its time to migrate over to RKE2 1.25. As long as you have disabled/removed any custom or user added PSPs, RKE2 can handle the transition of its own PSP to PSA manifests just fine.