remove policy violation from types.go

kyverno · Nov 11, 2020 · 58bc63e · 58bc63e
1 parent 2292bf8
commit 58bc63e
Show file tree

Hide file tree

Showing 29 changed files with 197 additions and 1,717 deletions.
diff --git a/charts/kyverno/templates/clusterrole.yaml b/charts/kyverno/templates/clusterrole.yaml
@@ -7,7 +7,7 @@ rules:
 - apiGroups: ["kyverno.io"]
   resources:
   - policyviolations
-  verbs: ["get", "list", "watch"]
+  verbs: ["get", "list", "watch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -84,10 +84,6 @@ rules:
   - policies/status
   - clusterpolicies
   - clusterpolicies/status
-  - clusterpolicyviolations
-  - clusterpolicyviolations/status
-  - policyviolations
-  - policyviolations/status
   - generaterequests
   - generaterequests/status
   verbs:

diff --git a/definitions/github/rbac.yaml b/definitions/github/rbac.yaml
@@ -30,10 +30,6 @@ rules:
     resources:
       - clusterpolicies
       - clusterpolicies/status
-      - clusterpolicyviolations
-      - clusterpolicyviolations/status
-      - policyviolations
-      - policyviolations/status
       - generaterequests
       - generaterequests/status
     verbs:

diff --git a/definitions/install.yaml b/definitions/install.yaml
@@ -1986,10 +1986,6 @@ rules:
   - policyreports/status
   - clusterpolicyreports
   - clusterpolicyreports/status
-  - clusterpolicyviolations
-  - clusterpolicyviolations/status
-  - policyviolations
-  - policyviolations/status
   - generaterequests
   - generaterequests/status
   - reportchangerequests
@@ -2165,22 +2161,6 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-  name: kyverno:edit-policies-policyviolations
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - policyviolations
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
 metadata:
   name: kyverno:policyreport
 rules:
@@ -2209,6 +2189,7 @@ rules:
   - get
   - list
   - watch
+  - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -2228,39 +2209,6 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-  name: kyverno:view-clusterpolicyviolations
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - clusterpolicyviolations
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-  name: kyverno:view-policies-policyviolations
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - policyviolations
-  - policies
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
 metadata:
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -2329,6 +2277,19 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  name: kyverno:policyviolations
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:policyviolations
+subjects:
+- kind: ServiceAccount
+  name: kyverno-service-account
+  namespace: kyverno
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   name: kyverno:userinfo
 roleRef:

diff --git a/definitions/install_debug.yaml b/definitions/install_debug.yaml
@@ -1986,10 +1986,6 @@ rules:
   - policyreports/status
   - clusterpolicyreports
   - clusterpolicyreports/status
-  - clusterpolicyviolations
-  - clusterpolicyviolations/status
-  - policyviolations
-  - policyviolations/status
   - generaterequests
   - generaterequests/status
   - reportchangerequests
@@ -2165,22 +2161,6 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-  name: kyverno:edit-policies-policyviolations
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - policyviolations
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
 metadata:
   name: kyverno:policyreport
 rules:
@@ -2209,6 +2189,7 @@ rules:
   - get
   - list
   - watch
+  - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
@@ -2228,39 +2209,6 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-  name: kyverno:view-clusterpolicyviolations
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - clusterpolicyviolations
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-  name: kyverno:view-policies-policyviolations
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - policyviolations
-  - policies
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
 metadata:
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -2329,6 +2277,19 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  name: kyverno:policyviolations
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:policyviolations
+subjects:
+- kind: ServiceAccount
+  name: kyverno-service-account
+  namespace: kyverno
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   name: kyverno:userinfo
 roleRef:

diff --git a/definitions/k8s-resource/rbac.yaml b/definitions/k8s-resource/rbac.yaml
@@ -32,7 +32,7 @@ rules:
 - apiGroups: ["kyverno.io"]
   resources:
   - policyviolations
-  verbs: ["get", "list", "watch"]
+  verbs: ["get", "list", "watch", "delete"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -73,6 +73,19 @@ subjects:
   name: kyverno-service-account
   namespace: kyverno
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kyverno:policyviolations
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:policyviolations
+subjects:
+- kind: ServiceAccount
+  name: kyverno-service-account
+  namespace: kyverno
+---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -180,10 +193,6 @@ rules:
   - policyreports/status
   - clusterpolicyreports
   - clusterpolicyreports/status
-  - clusterpolicyviolations
-  - clusterpolicyviolations/status
-  - policyviolations
-  - policyviolations/status
   - generaterequests
   - generaterequests/status
   - reportchangerequests
@@ -254,31 +263,6 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
-metadata:
-  name: kyverno:view-policies-policyviolations
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-rules:
-- apiGroups: ["kyverno.io"]
-  resources:
-  - policyviolations
-  - policies
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: kyverno:view-clusterpolicyviolations
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-rules:
-- apiGroups: ["kyverno.io"]
-  resources:
-  - clusterpolicyviolations
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
 metadata:
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -373,20 +357,4 @@ rules:
       - policyreport
       - clusterpolicyreport
     verbs:
-      - '*'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-  name: kyverno:edit-policies-policyviolations
-rules:
-- apiGroups: 
-  - kyverno.io
-  resources:
-  - policyviolations
-  verbs: 
-  - get
-  - list
-  - watch
+      - '*'