From df88b1a771b91a98caa8b1a1bb4280fb07795bfc Mon Sep 17 00:00:00 2001 From: Jan Safranek Date: Wed, 6 Nov 2024 13:05:36 +0100 Subject: [PATCH] Add all RBAC rules for the SELinux controller The SELinuxWarningController does not necessarily need permissions to read the objects, because it gets them through a shared informer instantiated by KCM itself, but let's list the permissions for completeness. --- .../auth/authorizer/rbac/bootstrappolicy/controller_policy.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go index a6e10a663b5..c3db5899194 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go @@ -506,6 +506,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding) ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "selinux-warning-controller"}, Rules: []rbacv1.PolicyRule{ eventsRule(), + rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumes").RuleOrDie(), + rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(), + rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("pods").RuleOrDie(), + rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("csidrivers").RuleOrDie(), }, }) }