restrict visibility on openshift-network-features
@@ -157,7 +157,8 @@ var (
},
"openshift-config-managed": {
rbacv1helpers.NewRule("get").Groups(legacyGroup).Resources("configmaps").Names("console-public").RuleOrDie(),
- rbacv1helpers.NewRule(read...).Groups("").Resources("configmaps").Names("oauth-serving-cert", "openshift-network-features").RuleOrDie(),
+ rbacv1helpers.NewRule(read...).Groups("").Resources("configmaps").Names("oauth-serving-cert").RuleOrDie(),
+ rbacv1helpers.NewRule("get").Groups("").Resources("configmaps").Names("openshift-network-features").RuleOrDie(),
},
"kube-system": {
// this allows every authenticated user to use in-cluster client certificate termination
