mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-04-08 10:04:25 +00:00
Code Activity

feat: add more granular rbac rules to remove wildcards ()

Browse source 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2024-01-24 17:07:18 +01:00 • committed by GitHub
parent 3ef598c155
commit 451d362104
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 84 additions and 0 deletions
charts/kyverno/templates
admission-controller
clusterrole.yaml
reports-controller
clusterrole.yaml
config
install-latest-testing.yaml

29
charts/kyverno/templates/admission-controller/clusterrole.yaml
View file

@ -58,6 +58,7 @@ rules:
- clusteradmissionreports
- backgroundscanreports
- clusterbackgroundscanreports
- policyexceptions
verbs:
- create
- delete
@ -98,6 +99,34 @@ rules:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- ''
resources:
- configmaps
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- create
- update
- patch
- get
- list
- watch
- apiGroups:
- '*'
resources:

13
charts/kyverno/templates/reports-controller/clusterrole.yaml
View file

@ -26,6 +26,16 @@ rules:
- get
- list
- watch
- apiGroups:
- ''
resources:
- secrets
- configmaps
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- kyverno.io
resources:
@ -33,6 +43,9 @@ rules:
- clusteradmissionreports
- backgroundscanreports
- clusterbackgroundscanreports
- policyexceptions
- policies
- clusterpolicies
verbs:
- create
- delete

42
config/install-latest-testing.yaml
View file

@ -49265,6 +49265,7 @@ rules:
- clusteradmissionreports
- backgroundscanreports
- clusterbackgroundscanreports
- policyexceptions
verbs:
- create
- delete
@ -49305,6 +49306,34 @@ rules:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- ''
resources:
- configmaps
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- create
- update
- patch
- get
- list
- watch
- apiGroups:
- '*'
resources:
@ -49747,6 +49776,16 @@ rules:
- get
- list
- watch
- apiGroups:
- ''
resources:
- secrets
- configmaps
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- kyverno.io
resources:
@ -49754,6 +49793,9 @@ rules:
- clusteradmissionreports
- backgroundscanreports
- clusterbackgroundscanreports
- policyexceptions
- policies
- clusterpolicies
verbs:
- create
- delete