perm2

cluster-resources/policies/replicaset-cleaner.yaml

@@ -1,3 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:pods-replicasets:manage
+  labels:
+    rbac.kyverno.io/aggregate-to-cleanup-controller: "true"
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - replicasets
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+---
 apiVersion: kyverno.io/v2
 kind: ClusterCleanupPolicy
 metadata:

cluster-resources/policies/secret-cloner.yaml

@@ -1,19 +1,16 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kyverno:resources:view
+  name: kyverno:secrets:view
   labels:
     rbac.kyverno.io/aggregate-to-admission-controller: "true"
     rbac.kyverno.io/aggregate-to-reports-controller: "true"
     rbac.kyverno.io/aggregate-to-background-controller: "true"
-    rbac.kyverno.io/aggregate-to-cleanup-controller: "true"
 rules:
 - apiGroups:
   - ''
   resources:
   - secrets
-  - pod
-  - replicaset
   verbs:
   - get
   - list
@@ -22,17 +19,14 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kyverno:resources:manage
+  name: kyverno:secrets:manage
   labels:
     rbac.kyverno.io/aggregate-to-background-controller: "true"
-    rbac.kyverno.io/aggregate-to-cleanup-controller: "true"
 rules:
 - apiGroups:
   - ''
   resources:
   - secrets
-  - pod
-  - replicaset
   verbs:
   - create
   - update