Restrict cluster role permissions in helm chart
@@ -10,11 +10,46 @@ items:
name: {{ template "cf-operator.fullname" . }}
rules:
- apiGroups:
- - '*'
+ - certificates.k8s.io
resources:
- - '*'
+ - certificatesigningrequests
verbs:
- - '*'
+ - create
+ - get
+ - list
+ - update
+ - watch
+ - apiGroups:
+ - certificates.k8s.io
+ resources:
+ - certificatesigningrequests/approval
+ verbs:
+ - create
+ - update
+ - apiGroups:
+ - apiextensions.k8s.io
+ resources:
+ - customresourcedefinitions
+ verbs:
+ - create
+ - get
+ - update
+ - apiGroups:
+ - ""
+ resources:
+ - namespaces
+ verbs:
+ - get
+ - update
+ - apiGroups:
+ - admissionregistration.k8s.io
+ resources:
+ - validatingwebhookconfigurations
+ - mutatingwebhookconfigurations
+ verbs:
+ - create
+ - delete
+ - update
- kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
