Merge pull request #529 from alexashley/policy-trust-root

Allow policy-controller to manage sigstore keys configmap
sigstore · May 16, 2023 · 33299c9 · 33299c9
2 parents 5c098c8 + 24457ea
commit 33299c9
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/charts/policy-controller/Chart.yaml b/charts/policy-controller/Chart.yaml
@@ -8,7 +8,7 @@ sources:
 type: application
 
 name: policy-controller
-version: 0.5.7
+version: 0.5.8
 appVersion: 0.7.0
 
 maintainers:

diff --git a/charts/policy-controller/README.md b/charts/policy-controller/README.md
@@ -1,6 +1,6 @@
 # policy-controller
 
-![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.7.0](https://img.shields.io/badge/AppVersion-0.7.0-informational?style=flat-square)
+![Version: 0.5.8](https://img.shields.io/badge/Version-0.5.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.7.0](https://img.shields.io/badge/AppVersion-0.7.0-informational?style=flat-square)
 
 The Helm chart for Policy  Controller
 

diff --git a/charts/policy-controller/templates/policy-webhook/role_policy_webhook.yaml b/charts/policy-controller/templates/policy-webhook/role_policy_webhook.yaml
@@ -39,6 +39,13 @@ rules:
     resourceNames: ["config-image-policies"]
     verbs: ["get", "list", "create", "update", "patch", "watch"]
 
+  # This is needed to create / patch ConfigMap that is created by the reconciler
+  # to consolidate various TrustRoot configuration into SigstoreKeys ConfigMap.
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["config-sigstore-keys"]
+    verbs: ["get", "list", "create", "update", "patch", "watch"]
+
   - apiGroups: ["policy.sigstore.dev"]
     resources: ["trustroots"]
     verbs: ["get", "list"]