From 935577f8e7083ee704819a9b75c2832c9e1c5b9f Mon Sep 17 00:00:00 2001 From: Matt Moyer Date: Mon, 2 Nov 2020 15:10:00 -0600 Subject: [PATCH] Give the concierge access to use any PodSecurityPolicy. This is needed on clusters with PodSecurityPolicy enabled by default, but should be harmless in other cases. This is generally needed because a restrictive PodSecurityPolicy will usually otherwise prevent the `hostPath` volume mount needed by the dynamically-created cert agent pod. Signed-off-by: Matt Moyer --- deploy/concierge/rbac.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deploy/concierge/rbac.yaml b/deploy/concierge/rbac.yaml index 90b00d7df..4f4c33050 100644 --- a/deploy/concierge/rbac.yaml +++ b/deploy/concierge/rbac.yaml @@ -21,6 +21,9 @@ rules: - apiGroups: [ admissionregistration.k8s.io ] resources: [ validatingwebhookconfigurations, mutatingwebhookconfigurations ] verbs: [ get, list, watch ] + - apiGroups: [ policy ] + resources: [ podsecuritypolicies ] + verbs: [ use ] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1