From e9a38aa76d296970f8c9f79234ea3136428f6d03 Mon Sep 17 00:00:00 2001
From: Shubham Bhardwaj <shubbhar@redhat.com>
Date: Tue, 18 Aug 2026 15:14:44 +0530
Subject: [PATCH] fix(rbac): harden ClusterRole to least-privilege

  Remove unused Knative boilerplate RBAC that granted permissions the
  controller and webhook never exercise, reducing post-compromise blast
  radius.

  - Namespace: reduce from full CRUD to get/list/watch; remove
    namespaces/finalizers (never referenced in code)
  - Webhook configs: remove mutatingwebhookconfigurations entirely
    (no mutating webhook exists); scope validatingwebhookconfigurations
    to resourceNames + get/update only
  - Secrets: remove cluster-wide get/list/watch (namespaced Role in
    tekton-pipelines already covers it); switch webhook secret informer
    from cluster-scoped to namespace-scoped import

Signed-off-by: Shubham Bhardwaj <shubbhar@redhat.com>
---
 cmd/webhook/main.go         |  2 +-
 config/200-clusterrole.yaml | 33 ++++-----------------------------
 2 files changed, 5 insertions(+), 30 deletions(-)

diff --git a/cmd/webhook/main.go b/cmd/webhook/main.go
index 7c007c16..c362c120 100644
--- a/cmd/webhook/main.go
+++ b/cmd/webhook/main.go
@@ -22,9 +22,9 @@ import (
 	"github.com/tektoncd/pruner/pkg/webhook"
 	"k8s.io/client-go/tools/cache"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
-	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
+	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
 	"knative.dev/pkg/injection/sharedmain"
 	"knative.dev/pkg/logging"
 	"knative.dev/pkg/signals"
diff --git a/config/200-clusterrole.yaml b/config/200-clusterrole.yaml
index 1e4a7cb8..2f4557c9 100644
--- a/config/200-clusterrole.yaml
+++ b/config/200-clusterrole.yaml
@@ -46,22 +46,18 @@ rules:
       - "patch"
       - "watch"
 
-  # used in webhook
+  # used in webhook — scoped to the single ValidatingWebhookConfiguration
   - apiGroups:
       - admissionregistration.k8s.io
     resources:
-      - mutatingwebhookconfigurations
       - validatingwebhookconfigurations
+    resourceNames:
+      - validation.webhook.pruner.tekton.dev
     verbs:
       - get
-      - list
-      - create
       - update
-      - delete
-      - patch
-      - watch
 
-  # used in webhook
+  # namespace informer (read-only)
   - apiGroups:
       - ""
     resources:
@@ -69,19 +65,8 @@ rules:
     verbs:
       - get
       - list
-      - create
-      - update
-      - delete
-      - patch
       - watch
 
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces/finalizers
-    verbs:
-      - update
-
   - apiGroups:
       - ""
     resources:
@@ -99,13 +84,3 @@ rules:
       - tekton-pruner-namespace-spec
     verbs:
       - get
-
-  # used in webhook for certificate management
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch