[cherry-pick: release-v0.4.x] fix(rbac): harden ClusterRole to least-privilege

cmd/webhook/main.go

@@ -22,9 +22,9 @@ import (
 	"github.com/tektoncd/pruner/pkg/webhook"
 	"k8s.io/client-go/tools/cache"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
-	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
+	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
 	"knative.dev/pkg/injection/sharedmain"
 	"knative.dev/pkg/logging"
 	"knative.dev/pkg/signals"

config/200-clusterrole.yaml

@@ -46,42 +46,27 @@ rules:
       - "patch"
       - "watch"
 
-  # used in webhook
+  # used in webhook — scoped to the single ValidatingWebhookConfiguration
   - apiGroups:
       - admissionregistration.k8s.io
     resources:
-      - mutatingwebhookconfigurations
       - validatingwebhookconfigurations
+    resourceNames:
+      - validation.webhook.pruner.tekton.dev
     verbs:
       - get
-      - list
-      - create
       - update
-      - delete
-      - patch
-      - watch
 
-  # used in webhook
+  # namespace informer (read-only)
   - apiGroups:
       - ""
     resources:
       - namespaces
     verbs:
       - get
       - list
-      - create
-      - update
-      - delete
-      - patch
       - watch
 
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces/finalizers
-    verbs:
-      - update
-
   - apiGroups:
       - ""
     resources:
@@ -99,13 +84,3 @@ rules:
       - tekton-pruner-namespace-spec
     verbs:
       - get
-
-  # used in webhook for certificate management
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch