Added aggregated view clusterroles

definitions/install.yaml

@@ -617,6 +617,38 @@ rules:
   - list
   - watch
 ---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  name: kyverno:view-clusterpolicyviolations
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - clusterpolicyviolations
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: kyverno:view-policyviolations
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - policyviolations
+  verbs:
+  - get
+  - list
+  - watch
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

definitions/install_debug.yaml

@@ -617,6 +617,38 @@ rules:
   - list
   - watch
 ---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  name: kyverno:view-clusterpolicyviolations
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - clusterpolicyviolations
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: kyverno:view-policyviolations
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - policyviolations
+  verbs:
+  - get
+  - list
+  - watch
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

definitions/rbac/rbac.yaml

@@ -240,3 +240,27 @@ metadata:
 data:
   # resource types to be skipped by kyverno policy engine
   resourceFilters: "[Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][*,kyverno,*][Binding,*,*][ReplicaSet,*,*]"
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: kyverno:view-policyviolations
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+- apiGroups: ["kyverno.io"]
+  resources:
+  - policyviolations
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: kyverno:view-clusterpolicyviolations
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+- apiGroups: ["kyverno.io"]
+  resources:
+  - clusterpolicyviolations
+  verbs: ["get", "list", "watch"]

documentation/installation.md

@@ -7,6 +7,9 @@ You can install Kyverno using the Helm chart or YAML files in this repository.
 ## Install Kyverno using Helm
 
 ```sh
+## install Kyverno CRD
+kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/crd.yaml
+
 ## Add the nirmata Helm repository
 helm repo add kyverno https://nirmata.github.io/kyverno/
 
@@ -35,6 +38,7 @@ Kyverno can request a CA signed certificate-key pair from `kube-controller-manag
 To install Kyverno in a cluster that supports certificate signing, run the following command on a host with kubectl `cluster-admin` access:
 
 ````sh
+## Deploy Kyverno 
 kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml
 ````