Account for discovered policies(kyverno, vapb etc) in aggregaterole

This will allow the discovered policies table to show kyverno policies(clusterPolicy, policy), gatekeeper mutations, validatingAdmissionPolicyBinding, policyreports for view users. Signed-off-by: yiraeChristineKim <[email protected]>
stolostron · Jan 9, 2025 · ea72ae6 · ea72ae6
1 parent dcf6c55
commit ea72ae6
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 3 deletions.
diff --git a/pkg/templates/multiclusterhub/base/clusterrole-admin-aggregate.yaml b/pkg/templates/multiclusterhub/base/clusterrole-admin-aggregate.yaml
@@ -27,8 +27,17 @@ rules:
   resources: ["klusterletaddonconfigs"]
   verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection", "patch"]
 - apiGroups: ["wgpolicyk8s.io"]
-  resources: ["policyreports"]
+  resources: ["policyreports", "clusterpolicyreports"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["submarineraddon.open-cluster-management.io"]
   resources: ["submarinerconfigs", "submarinerconfigs/status"]
   verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection", "patch"]
+- apiGroups: ["mutations.gatekeeper.sh"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection", "patch"]
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["validatingadmissionpolicybindings"]
+  verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection", "patch"]
+- apiGroups: ["kyverno.io"]
+  resources: ["policies", "clusterpolicies"]
+  verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection", "patch"]
diff --git a/pkg/templates/multiclusterhub/base/clusterrole-edit-aggregate.yaml b/pkg/templates/multiclusterhub/base/clusterrole-edit-aggregate.yaml
@@ -26,8 +26,14 @@ rules:
   resources: ["klusterletaddonconfigs"]
   verbs: ["get", "list", "watch", "update", "patch"]
 - apiGroups: ["wgpolicyk8s.io"]
-  resources: ["policyreports"]
+  resources: ["policyreports", "clusterpolicyreports"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["submarineraddon.open-cluster-management.io"]
   resources: ["submarinerconfigs", "submarinerconfigs/status"]
   verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: ["mutations.gatekeeper.sh"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["validatingadmissionpolicybindings"]
+  verbs: ["get", "list", "watch", "update", "patch"]
diff --git a/pkg/templates/multiclusterhub/base/clusterrole-view-aggregate.yaml b/pkg/templates/multiclusterhub/base/clusterrole-view-aggregate.yaml
@@ -26,8 +26,17 @@ rules:
   resources: ["klusterletaddonconfigs"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["wgpolicyk8s.io"]
-  resources: ["policyreports"]
+  resources: ["policyreports", "clusterpolicyreports"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["submarineraddon.open-cluster-management.io"]
   resources: ["submarinerconfigs", "submarinerconfigs/status"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["mutations.gatekeeper.sh"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["validatingadmissionpolicybindings"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["kyverno.io"]
+  resources: ["policies", "clusterpolicies"]
+  verbs: ["get", "list", "watch"]