Merge pull request #618 from sluetze/sandboxed-containers

add read permission for kataconfig

Author: yuumasato

bundle/manifests/compliance-operator.clusterserviceversion.yaml

@@ -1098,6 +1098,13 @@ spec:
           verbs:
           - get
           - list
+        - apiGroups:
+          - kataconfiguration.openshift.io
+          resources:
+          - kataconfigs
+          verbs:
+          - list
+          - get
         serviceAccountName: api-resource-collector
       - rules:
         - apiGroups:

config/manifests/bases/compliance-operator.clusterserviceversion.yaml

@@ -1176,6 +1176,13 @@ spec:
           - get
           - list
           - watch
+        - apiGroups:
+          - kataconfiguration.openshift.io
+          resources:
+          - kataconfigs
+          verbs:
+          - list
+          - get
         serviceAccountName: api-resource-collector
       - rules:
         - apiGroups:

config/rbac/api_resource_collector_cluster_role.yaml

@@ -867,3 +867,11 @@ rules:
     verbs:
       - get
       - list
+  # Necessary to check for sandboxed-containers config for BSI requirements
+  - apiGroups:
+      - kataconfiguration.openshift.io
+    verbs:
+      - list
+      - get
+    resources:
+      - kataconfigs