Add read access for ValidatingAdmissionPolicy and ValidatingAdmission…

…PolicyBinding resources. (kubernetes-sigs#3190)
openshift-kannon92 · Nov 19, 2024 · 94a2896 · 94a2896
1 parent 981fe99
commit 94a2896
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 0 deletions.
diff --git a/charts/kueue/templates/rbac/role.yaml b/charts/kueue/templates/rbac/role.yaml
@@ -78,6 +78,15 @@ rules:
       - list
       - update
       - watch
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - validatingadmissionpolicies
+      - validatingadmissionpolicybindings
+    verbs:
+      - get
+      - list
+      - watch
   - apiGroups:
       - autoscaling.x-k8s.io
     resources:

diff --git a/config/components/rbac/role.yaml b/config/components/rbac/role.yaml
@@ -77,6 +77,15 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingadmissionpolicies
+  - validatingadmissionpolicybindings
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - autoscaling.x-k8s.io
   resources:

diff --git a/pkg/util/cert/cert.go b/pkg/util/cert/cert.go
@@ -38,6 +38,8 @@ const (
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;update
 // +kubebuilder:rbac:groups="admissionregistration.k8s.io",resources=mutatingwebhookconfigurations,verbs=get;list;watch;update
 // +kubebuilder:rbac:groups="admissionregistration.k8s.io",resources=validatingwebhookconfigurations,verbs=get;list;watch;update
+// +kubebuilder:rbac:groups="admissionregistration.k8s.io",resources=validatingadmissionpolicies,verbs=get;list;watch
+// +kubebuilder:rbac:groups="admissionregistration.k8s.io",resources=validatingadmissionpolicybindings,verbs=get;list;watch
 
 // ManageCerts creates all certs for webhooks. This function is called from main.go.
 func ManageCerts(mgr ctrl.Manager, cfg config.Configuration, setupFinished chan struct{}) error {