fix: aggregate clusterrole to admission controller

Signed-off-by: ShutingZhao <[email protected]>
realshuting · Sep 3, 2024 · 968a797 · 968a797
1 parent 954ac6c
commit 968a797
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 0 deletions.
diff --git a/...mance/chainsaw/events/clusterpolicy/generate-events-upon-fail-generation/permissions.yaml b/...mance/chainsaw/events/clusterpolicy/generate-events-upon-fail-generation/permissions.yaml
@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:rbac
+  labels:
+    rbac.kyverno.io/aggregate-to-background-controller: "true"
+    rbac.kyverno.io/aggregate-to-admission-controller: "true"
+rules:
+- apiGroups:
+  - iam.aws.crossplane.io
+  resources:
+  - roles
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
diff --git a/test/conformance/chainsaw/generate/validation/clusterpolicy/cloneList/permissions.yaml b/test/conformance/chainsaw/generate/validation/clusterpolicy/cloneList/permissions.yaml
@@ -17,4 +17,25 @@ rules:
   - watch
   - create
   - update
+  - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:rbac
+  labels:
+    rbac.kyverno.io/aggregate-to-background-controller: "true"
+    rbac.kyverno.io/aggregate-to-admission-controller: "true"
+rules:
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  - clusterrolebindings
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
   - delete