fix: add permissions to patch events

[hectorj2f]

Signed-off-by: hectorj2f hectorf@vmware.com

Summary

When looking at the logs from the policy-webhook pod, I found errors while patching events such as:

E0407 15:32:56.528437       1 event.go:267] Server rejected event '&v1.Event{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ObjectMeta:v1.ObjectMeta{Name:"image-hectorj2f-policy.16e3a4a2d537e800", GenerateName:"", Namespace:"default", SelfLink:"", UID:"", ResourceVersion:"6750", Generation:0, CreationTimestamp:time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC), DeletionTimestamp:<nil>, DeletionGracePeriodSeconds:(*int64)(nil), Labels:map[string]string(nil), Annotations:map[string]string(nil), OwnerReferences:[]v1.OwnerReference(nil), Finalizers:[]string(nil), ClusterName:"", ManagedFields:[]v1.ManagedFieldsEntry(nil)}, InvolvedObject:v1.ObjectReference{Kind:"ClusterImagePolicy", Namespace:"", Name:"image-hectorj2f-policy", UID:"0e2d2952-e524-44a9-8bfc-3641c559f863", APIVersion:"cosigned.sigstore.dev/v1alpha1", ResourceVersion:"13141", FieldPath:""}, Reason:"FinalizerUpdate", Message:"Updated \"image-hectorj2f-policy\" finalizers", Source:v1.EventSource{Component:"clusterimagepolicy-controller", Host:""}, FirstTimestamp:time.Date(2022, time.April, 7, 14, 48, 27, 0, time.Local), LastTimestamp:time.Date(2022, time.April, 7, 15, 32, 56, 522014000, time.Local), Count:3, Type:"Normal", EventTime:time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC), Series:(*v1.EventSeries)(nil), Action:"", Related:(*v1.ObjectReference)(nil), ReportingController:"", ReportingInstance:""}': 'events "image-hectorj2f-policy.16e3a4a2d537e800" is forbidden: User "system:serviceaccount:cosign-system:webhook" cannot patch resource "events" in API group "" in the namespace "default"' (will not retry!)

I added the permissions to patch events too, so we can see now events:

$kubectl get events -A

NAMESPACE      LAST SEEN   TYPE     REASON            OBJECT                                      MESSAGE
default        4m22s       Normal   FinalizerUpdate   clusterimagepolicy/image-hectorj2f-policy   Updated "image-hectorj2f-policy" finalizers

Ticket Link

Fixes

Release Note