add watch policy to clusterrole kyverno:customresources (#1084)

charts/kyverno/crds/crds.yaml

@@ -31,6 +31,10 @@ spec:
                         type: array
                       resources:
                         properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
                           kinds:
                             items:
                               type: string
@@ -41,10 +45,6 @@ spec:
                             items:
                               type: string
                             type: array
-                          annotations:
-                            type: object
-                            additionalProperties:
-                              type: string
                           selector:
                             properties:
                               matchExpressions:
@@ -125,6 +125,10 @@ spec:
                       resources:
                         minProperties: 1
                         properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
                           kinds:
                             items:
                               type: string
@@ -135,10 +139,6 @@ spec:
                             items:
                               type: string
                             type: array
-                          annotations:
-                            type: object
-                            additionalProperties:
-                              type: string
                           selector:
                             properties:
                               matchExpressions:

charts/kyverno/templates/clusterrole.yaml

@@ -80,6 +80,8 @@ rules:
 - apiGroups:
   - '*'
   resources:
+  - policies
+  - policies/status
   - clusterpolicies
   - clusterpolicies/status
   - clusterpolicyviolations

definitions/install.yaml

@@ -763,6 +763,8 @@ rules:
 - apiGroups:
   - '*'
   resources:
+  - policies
+  - policies/status
   - clusterpolicies
   - clusterpolicies/status
   - clusterpolicyviolations

definitions/install_debug.yaml

@@ -36,6 +36,10 @@ spec:
                         type: array
                       resources:
                         properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
                           kinds:
                             items:
                               type: string
@@ -46,10 +50,6 @@ spec:
                             items:
                               type: string
                             type: array
-                          annotations:
-                            type: object
-                            additionalProperties:
-                              type: string
                           selector:
                             properties:
                               matchExpressions:
@@ -130,6 +130,10 @@ spec:
                       resources:
                         minProperties: 1
                         properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            type: object
                           kinds:
                             items:
                               type: string
@@ -140,10 +144,6 @@ spec:
                             items:
                               type: string
                             type: array
-                          annotations:
-                            type: object
-                            additionalProperties:
-                              type: string
                           selector:
                             properties:
                               matchExpressions:
@@ -763,6 +763,8 @@ rules:
 - apiGroups:
   - '*'
   resources:
+  - policies
+  - policies/status
   - clusterpolicies
   - clusterpolicies/status
   - clusterpolicyviolations
@@ -885,6 +887,37 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  name: kyverno:admin-policies
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - policies
+  verbs:
+  - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: kyverno:edit-policies-policyviolations
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - policyviolations
+  - policies
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
 metadata:
   name: kyverno:policyviolations
 rules:
@@ -918,12 +951,13 @@ kind: ClusterRole
 metadata:
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-  name: kyverno:view-policyviolations
+  name: kyverno:view-policies-policyviolations
 rules:
 - apiGroups:
   - kyverno.io
   resources:
   - policyviolations
+  - policies
   verbs:
   - get
   - list

definitions/k8s-resource/rbac.yaml

@@ -170,6 +170,8 @@ rules:
 - apiGroups:
   - '*'
   resources:
+  - policies
+  - policies/status
   - clusterpolicies
   - clusterpolicies/status
   - clusterpolicyviolations

definitions/release/install.yaml

@@ -763,6 +763,8 @@ rules:
 - apiGroups:
   - '*'
   resources:
+  - policies
+  - policies/status
   - clusterpolicies
   - clusterpolicies/status
   - clusterpolicyviolations