Extending RBAC Rules to allow scan hooks to create new scans (used by imperative-subsequent-scans)

rfelber · rfelber · commit 17e451ed6357 · 2020-06-12T12:59:08.000+02:00
diff --git a/operator/Chart.yaml b/operator/Chart.yaml
@@ -10,7 +10,7 @@ version: 0.1.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 1.17.0
+appVersion: 1.18.0
 
 dependencies:
   - name: minio
diff --git a/operator/controllers/execution/scan_controller.go b/operator/controllers/execution/scan_controller.go
@@ -686,7 +686,7 @@ func (r *ScanReconciler) startReadOnlyHooks(scan *executionv1.Scan) error {
 		{
 			APIGroups: []string{"execution.experimental.securecodebox.io"},
 			Resources: []string{"scans"},
-			Verbs:     []string{"get"},
+			Verbs:     []string{"get", "create", "list"},
 		},
 	}
 	serviceAccountName := "scan-completion-hook"

Original file line number	Diff line number	Diff line change
`@@ -686,7 +686,7 @@ func (r ScanReconciler) startReadOnlyHooks(scan executionv1.Scan) error {`
`686`	`686`	`{`
`687`	`687`	`APIGroups: []string{"execution.experimental.securecodebox.io"},`
`688`	`688`	`Resources: []string{"scans"},`
`689`		`- Verbs: []string{"get"},`
	`689`	`+ Verbs: []string{"get", "create", "list"},`
`690`	`690`	`},`
`691`	`691`	`}`
`692`	`692`	`serviceAccountName := "scan-completion-hook"`