Explanation

This PR passes the resource name if exists to the SubjectAccessReview. If it is empty, it means all.

Related issue

Closes #10198

Milestone of this PR

/milestone 1.12.2

Documentation (required for features)

My PR contains new or altered behavior to Kyverno.

• I have sent the draft PR to add or update the documentation and the link is:

What type of PR is this

/kind bug

Proposed Changes

Proof Manifests

1. Create the following clusterrole that allows the deletion of a secret called test-secret:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: cleanup-controller
    app.kubernetes.io/instance: kyverno
    app.kubernetes.io/part-of: kyverno
  name: kyverno:cleanup-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  resourceNames:
  - test-secret
  verbs:
  - list
  - delete

2. Create the following policy:

apiVersion: kyverno.io/v2beta1
kind: CleanupPolicy
metadata:
  name: test-secret-removal
spec:
  match:
    any:
    - resources:
        kinds:
        - Secret
        names:
        - test-secret
  schedule: "*/10 * * * *"

The policy is successfully created.

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.
• This is a feature and I have added CLI tests that are applicable.
• My PR needs to be cherry picked to a specific release branch which is .
• My PR contains new or altered behavior to Kyverno and
  • CLI support should be added and my PR doesn't contain that functionality.

Further Comments