added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,35 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.rbac.labels.admin" -}}
+{{- $labels := list
+  (include "kyverno.labels.common" .)
+  (include "kyverno.rbac.matchLabels" .)
+-}}
+{{- if .Values.rbac.roles.aggregate.admin -}}
+{{- $labels = append $labels "rbac.authorization.k8s.io/aggregate-to-admin: 'true'" -}}
+{{- end -}}
+{{- template "kyverno.labels.merge" $labels -}}
+{{- end -}}
+
+
+{{- define "kyverno.rbac.labels.view" -}}
+{{- $labels := list
+  (include "kyverno.labels.common" .)
+  (include "kyverno.rbac.matchLabels" .)
+-}}
+{{- if .Values.rbac.roles.aggregate.view -}}
+{{- $labels = append $labels "rbac.authorization.k8s.io/aggregate-to-view: 'true'" -}}
+{{- end -}}
+{{- template "kyverno.labels.merge" $labels -}}
+{{- end -}}
+
+{{- define "kyverno.rbac.matchLabels" -}}
+{{- template "kyverno.labels.merge" (list
+  (include "kyverno.matchLabels.common" .)
+  (include "kyverno.labels.component" "rbac")
+) -}}
+{{- end -}}
+
+{{- define "kyverno.rbac.roleName" -}}
+{{ include "kyverno.fullname" . }}:rbac
+{{- end -}}
@@ -0,0 +1,43 @@
+{{- if .Values.admissionController.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:admin:policies
+  labels:
+    {{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - kyverno.io
+    resources:
+      - cleanuppolicies
+      - clustercleanuppolicies
+      - policies
+      - clusterpolicies
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:view:policies
+  labels:
+    {{- include "kyverno.rbac.labels.view" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - kyverno.io
+    resources:
+      - cleanuppolicies
+      - clustercleanuppolicies
+      - policies
+      - clusterpolicies
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}
@@ -0,0 +1,39 @@
+{{- if .Values.admissionController.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:admin:policyreports
+  labels:
+    {{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - wgpolicyk8s.io
+    resources:
+      - policyreports
+      - clusterpolicyreports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:view:policyreports
+  labels:
+    {{- include "kyverno.rbac.labels.view" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - wgpolicyk8s.io
+    resources:
+      - policyreports
+      - clusterpolicyreports
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}
@@ -0,0 +1,39 @@
+{{- if .Values.admissionController.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:admin:reports
+  labels:
+    {{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - reports.kyverno.io
+    resources:
+      - ephemeralreports
+      - clusterephemeralreports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:view:reports
+  labels:
+    {{- include "kyverno.rbac.labels.view" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - reports.kyverno.io
+    resources:
+      - ephemeralreports
+      - clusterephemeralreports
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}
@@ -0,0 +1,37 @@
+{{- if .Values.admissionController.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:admin:updaterequests
+  labels:
+    {{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - kyverno.io
+    resources:
+      - updaterequests
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.rbac.roleName" . }}:view:updaterequests
+  labels:
+    {{- include "kyverno.rbac.labels.view" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - kyverno.io
+    resources:
+      - updaterequests
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}