Update manifests to restrict access to CRDs and webhooks
Updates RBAC manifest to only allow list access to all webhooks and CRDS, while permitting the original extended access specifically to MetalLB created resources.
@@ -39,6 +39,8 @@ rules:
resources:
- validatingwebhookconfigurations
- mutatingwebhookconfigurations
+ resourceNames:
+ - metallb-webhook-configuration
verbs:
- create
- delete
@@ -47,10 +49,25 @@ rules:
- patch
- update
- watch
+ - apiGroups:
+ - admissionregistration.k8s.io
+ resources:
+ - validatingwebhookconfigurations
+ - mutatingwebhookconfigurations
+ verbs:
+ - list
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
+ resourceNames:
+ - addresspools.metallb.io
+ - bfdprofiles.metallb.io
+ - bgpadvertisements.metallb.io
+ - bgppeers.metallb.io
+ - ipaddresspools.metallb.io
+ - l2advertisements.metallb.io
+ - communities.metallb.io
verbs:
- create
- delete
@@ -59,6 +76,12 @@ rules:
- patch
- update
- watch
+ - apiGroups:
+ - apiextensions.k8s.io
+ resources:
+ - customresourcedefinitions
+ verbs:
+ - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
