[Bug] Creation of CleanupPolicy to delete specific Secret fails due to admission webhook RBAC error

[steadyk]

Kyverno Version

1.11.4

Kubernetes Version

1.28.x

Kubernetes Platform

KinD

Kyverno Rule Type

Cleanup

Description

We tried to add the following CleanupPolicy to delete a certain Secret periodically:

apiVersion: kyverno.io/v2beta1
kind: CleanupPolicy
metadata:
  name: test-secret-removal
spec:
  match:
    any:
    - resources:
        kinds:
        - Secret
        names:
        - test-secret
  schedule: "*/10 * * * *"

For this we added the following additional RBAC rules for the cleanup controller to the Helm chart values:

cleanupController:
  rbac:
    clusterRole:
      extraResources:
      - apiGroups:
        - ''
        resources:
        - secrets
        verbs:
        - get
        - list
      - apiGroups:
        - ''
        resources:
        - secrets
        resourceNames:
        - test-secret
        verbs:
        - get
        - list
        - delete

The attempted creation of the new CleanupPolicy results in an error of the admission webhook:

admission webhook "kyverno-cleanup-controller.kyverno.svc" denied the request: cleanup controller has no permission to delete kind Secret

We were only able to create the CleanupPolicy after giving the cleanup controller permissions for delete on every Secret.

Note that we add get and list verbs on both rules though this might not be necessary.

We are also unsure whether there might be a discrepancy between the admission webhook validation and the actual requested permissions for the cleanup controller.

Steps to reproduce

1. Add RBAC rules to cleanup controller as described above
2. Try to apply CleanupPolicy as described above

Expected behavior

CleanupPolicy is successfully applied and is able to delete the given Secret specified by resource name.

Screenshots

No response

Kyverno logs

No response

Slack discussion

No response

Troubleshooting

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.