fix(vm): allow crud over internal resources for sa in kube-system and…

… d8 system namespaces (#665) allow crud over internal resources for sa in kube-system and d8 system namespaces --------- Signed-off-by: Yaroslav Borbat <[email protected]>
deckhouse · Jan 24, 2025 · 885563e · 885563e
1 parent 38ede7a
commit 885563e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/templates/admission-policy.yaml b/templates/admission-policy.yaml
@@ -35,6 +35,8 @@ spec:
         resources: ["*"]
   validations:
     - expression: |
+        request.userInfo.username.startsWith("system:serviceaccount:kube-system:") ||
+        request.userInfo.username.startsWith("system:serviceaccount:d8-system:") ||
         request.userInfo.username in [
           "system:serviceaccount:d8-virtualization:cdi-apiserver",
           "system:serviceaccount:d8-virtualization:cdi-cronjob",
@@ -50,7 +52,6 @@ spec:
           "system:serviceaccount:d8-virtualization:virtualization-api",
           "system:serviceaccount:d8-virtualization:virtualization-pre-delete-hook",
           "system:serviceaccount:d8-virtualization:vm-route-forge",
-          "system:serviceaccount:d8-system:deckhouse"
         ]
       message: "Operation forbidden for this user."
 ---