apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-pipelines-webhook-cluster-access
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipelines
rules:
# The webhook needs to be able to get and update customresourcedefinitions,
# mainly to update the webhook certificates.
- resources: ["customresourcedefinitions", "customresourcedefinitions/status"]
  apiGroups: ["apiextensions.k8s.io"]
  resourceNames:
  - pipelines.tekton.dev
  - pipelineruns.tekton.dev
  - runs.tekton.dev
  - tasks.tekton.dev
  - clustertasks.tekton.dev
  - taskruns.tekton.dev
  - pipelineresources.tekton.dev
  - conditions.tekton.dev
  verbs: ["get", "update", "patch"]
# knative.dev/pkg needs list/watch permissions to set up informers for the webhook.
- resources: ["customresourcedefinitions"]
  apiGroups: ["apiextensions.k8s.io"]
  verbs: ["list", "watch"]
- # The webhook performs a reconciliation on these two resources and continuously
  # updates configuration.
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
  apiGroups: ["admissionregistration.k8s.io"]
  # knative starts informers on these things, which is why we need get, list and watch.
  verbs: ["list", "watch"]
- resources: ["mutatingwebhookconfigurations"]
  apiGroups: ["admissionregistration.k8s.io"]
  # This mutating webhook is responsible for applying defaults to tekton objects
  # as they are received.
  resourceNames: ["webhook.pipeline.tekton.dev"]
  # When there are changes to the configs or secrets, knative updates the mutatingwebhook config
  # with the updated certificates or the refreshed set of rules.
  verbs: ["get", "update", "delete"]
- resources: ["validatingwebhookconfigurations"]
  apiGroups: ["admissionregistration.k8s.io"]
  # validation.webhook.pipeline.tekton.dev performs schema validation when you, for example, create TaskRuns.
  # config.webhook.pipeline.tekton.dev validates the logging configuration against knative's logging structure
  resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"]
  # When there are changes to the configs or secrets, knative updates the validatingwebhook config
  # with the updated certificates or the refreshed set of rules.
  verbs: ["get", "update", "delete"]
- resources: ["podsecuritypolicies"]
  apiGroups: ["policy"]
  resourceNames: ["tekton-pipelines"]
  verbs: ["use"]
- resources: ["namespaces"]
  apiGroups: [""]
  # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources,
  # which requires we can Get the system namespace.
  resourceNames: ["tekton-pipelines"]
  verbs: ["get"]
- resources: ["namespaces/finalizers"]
  apiGroups: [""]
  # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources,
  # which requires we can update the system namespace finalizers.
  resourceNames: ["tekton-pipelines"]
  verbs: ["update"]
