kyverno 3.9.0 추가 — 자체 빌드 이미지 사용, 3.4.1 정리 (#57)
* kyverno 3.9.0(appVersion v1.19.0) 차트 추가 — 자체 빌드 이미지 사용 업스트림 이미지가 CVE 스캔 불가능한 베이스를 써서 자체 빌드로 대체한다(빌드 정의·근거는 hardened-containers). custom-values.yaml이 docker.io/paasup/* 7개 이미지를 가리키도록 고정했다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * kyverno 3.4.1 삭제 3.9.0 추가 후 정리 --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
wbsong111
@@ -0,0 +1,35 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.rbac.labels.admin" -}}
|
||||
{{- $labels := list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.rbac.matchLabels" .)
|
||||
-}}
|
||||
{{- if .Values.rbac.roles.aggregate.admin -}}
|
||||
{{- $labels = append $labels "rbac.authorization.k8s.io/aggregate-to-admin: 'true'" -}}
|
||||
{{- end -}}
|
||||
{{- template "kyverno.labels.merge" $labels -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{- define "kyverno.rbac.labels.view" -}}
|
||||
{{- $labels := list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.rbac.matchLabels" .)
|
||||
-}}
|
||||
{{- if .Values.rbac.roles.aggregate.view -}}
|
||||
{{- $labels = append $labels "rbac.authorization.k8s.io/aggregate-to-view: 'true'" -}}
|
||||
{{- end -}}
|
||||
{{- template "kyverno.labels.merge" $labels -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.rbac.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "rbac")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.rbac.roleName" -}}
|
||||
{{ include "kyverno.fullname" . }}:rbac
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,83 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:policies
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- cleanuppolicies
|
||||
- clustercleanuppolicies
|
||||
- policies
|
||||
- clusterpolicies
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- deletingpolicies
|
||||
- generatingpolicies
|
||||
- imagevalidatingpolicies
|
||||
- mutatingpolicies
|
||||
- namespaceddeletingpolicies
|
||||
- namespacedgeneratingpolicies
|
||||
- namespacedimagevalidatingpolicies
|
||||
- namespacedmutatingpolicies
|
||||
- namespacedvalidatingpolicies
|
||||
- policyexceptions
|
||||
- validatingpolicies
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:policies
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- cleanuppolicies
|
||||
- clustercleanuppolicies
|
||||
- policies
|
||||
- clusterpolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- deletingpolicies
|
||||
- generatingpolicies
|
||||
- imagevalidatingpolicies
|
||||
- mutatingpolicies
|
||||
- namespaceddeletingpolicies
|
||||
- namespacedgeneratingpolicies
|
||||
- namespacedimagevalidatingpolicies
|
||||
- namespacedmutatingpolicies
|
||||
- namespacedvalidatingpolicies
|
||||
- policyexceptions
|
||||
- validatingpolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:policyreports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- clusterpolicyreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:policyreports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- clusterpolicyreports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:reports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:reports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,37 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:updaterequests
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- updaterequests
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:updaterequests
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- updaterequests
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
Reference in New Issue
Block a user