fix: aggregate clusterrole to admission controller

Signed-off-by: ShutingZhao <[email protected]>
realshuting · Sep 4, 2024 · e5f61f5 · e5f61f5
1 parent c3965e9
commit e5f61f5
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/...hainsaw/generate/clusterpolicy/cornercases/cpol-data-trigger-not-present/permissions.yaml b/...hainsaw/generate/clusterpolicy/cornercases/cpol-data-trigger-not-present/permissions.yaml
@@ -4,6 +4,7 @@ metadata:
   name: kyverno:rbac
   labels:
     rbac.kyverno.io/aggregate-to-background-controller: "true"
+    rbac.kyverno.io/aggregate-to-admission-controller: "true"
 rules:
 - apiGroups:
   - rbac.authorization.k8s.io

diff --git a/.../generate/validation/clusterpolicy/target-namespace-scope/chainsaw-step-01-apply-1-1.yaml b/.../generate/validation/clusterpolicy/target-namespace-scope/chainsaw-step-01-apply-1-1.yaml
@@ -10,15 +10,27 @@ metadata:
 rules:
 - apiGroups:
   - ""
-  - iam.aws.crossplane.io
   resources:
   - namespaces
-  - roles
   verbs:
   - create
   - update
   - delete
   - get
+- apiGroups:
+  - iam.aws.crossplane.io
+  resources:
+  - roles
+  verbs:
+  - list
+  - get
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - roles
+  verbs:
+  - list
+  - get
 - apiGroups:
   - kyverno.io
   resources: