Merge pull request #349 from dwertent/hot-fix-1.16.5

wip: Ignore account id if secret exists
kubescape · Dec 14, 2023 · d27aa5a · d27aa5a
2 parents 3d06b2b + 3e12035
commit d27aa5a
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/charts/kubescape-operator/templates/_helpers.tpl b/charts/kubescape-operator/templates/_helpers.tpl
@@ -23,7 +23,7 @@ otelPort : {{ if $otel }}{{ splitList ":" .Values.configurations.otelUrl | last
 runtimeObservability: {{ eq .Values.capabilities.runtimeObservability "enable" }}
 submit: {{ $submit }}
   {{- if $submit -}}
-    {{- if empty .Values.account -}}
+    {{- if and (empty .Values.account) $createCloudSecret -}}
       {{- fail "submitting is enabled but value for account is not defined: please register at https://cloud.armosec.io to get yours and re-run with  --set account=<your Guid>" }}
     {{- end -}}
     {{- if empty .Values.clusterName -}}

diff --git a/charts/kubescape-operator/templates/kubescape/clusterrole.yaml b/charts/kubescape-operator/templates/kubescape/clusterrole.yaml
@@ -6,7 +6,7 @@ metadata:
   name: {{ .Values.kubescape.name }}
 rules:
 - apiGroups: [""]
-  resources: ["pods", "pods/proxy", "namespaces", "secrets", "nodes", "configmaps", "services", "serviceaccounts", "endpoints", "persistentvolumeclaims", "limitranges", "replicationcontrollers", "podtemplates", "resourcequotas", "events"]
+  resources: ["pods", "pods/proxy", "namespaces", "secrets", "nodes", "configmaps", "services", "serviceaccounts", "endpoints", "persistentvolumeclaims", "persistentvolumes", "limitranges", "replicationcontrollers", "podtemplates", "resourcequotas", "events"]
   verbs: ["get", "watch", "list"]
 - apiGroups: ["admissionregistration.k8s.io"]
   resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
@@ -45,7 +45,7 @@ rules:
   resources: ["clusterroles", "clusterrolebindings", "roles", "rolebindings"]
   verbs: ["get", "watch", "list"]
 - apiGroups: ["storage.k8s.io"]
-  resources: ["csistoragecapacities"]
+  resources: ["csistoragecapacities", "StorageClass"]
   verbs: ["get", "watch", "list"]
 - apiGroups: ["networking.k8s.io"]
   resources: ["ingresses"]

diff --git a/charts/kubescape-operator/tests/__snapshot__/snapshot_test.yaml.snap b/charts/kubescape-operator/tests/__snapshot__/snapshot_test.yaml.snap
@@ -744,6 +744,7 @@ matches the snapshot:
           - serviceaccounts
           - endpoints
           - persistentvolumeclaims
+          - persistentvolumes
           - limitranges
           - replicationcontrollers
           - podtemplates
@@ -866,6 +867,7 @@ matches the snapshot:
           - storage.k8s.io
         resources:
           - csistoragecapacities
+          - StorageClass
         verbs:
           - get
           - watch