From 97074ee61ff4bb7f93f5e1b9036693069a015ad7 Mon Sep 17 00:00:00 2001 From: Nont Date: Tue, 28 Oct 2025 17:32:25 -0500 Subject: [PATCH] Add kube-system to the managedresource allowed list Signed-off-by: Nont --- pkg/webhook/managedresource/validatingadmissionpolicy.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/webhook/managedresource/validatingadmissionpolicy.go b/pkg/webhook/managedresource/validatingadmissionpolicy.go index 2c14fe56a..b5f150b99 100644 --- a/pkg/webhook/managedresource/validatingadmissionpolicy.go +++ b/pkg/webhook/managedresource/validatingadmissionpolicy.go @@ -63,13 +63,13 @@ func mutateValidatingAdmissionPolicy(vap *admv1.ValidatingAdmissionPolicy) { && ( "system:masters" in request.userInfo.groups || - "system:serviceaccounts:kube-system" in request.userInfo.groups || "system:serviceaccounts:fleet-system" in request.userInfo.groups ) ) || ( - "system:serviceaccounts:openshift-infra" in request.userInfo.groups + "system:serviceaccounts:openshift-infra" in request.userInfo.groups || + "system:serviceaccounts:kube-system" in request.userInfo.groups )`, Message: "Create, Update, or Delete operations on ARM managed resources is forbidden", Reason: &forbidden,