admission: Prevent leaking the validatingwebhookconfiguration resource in virtual garden cluster (#264)

Author: ialidzhikov

charts/gardener-extension-admission-acl/charts/application/templates/rbac.yaml

@@ -31,8 +31,16 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  resourceNames:
+  - {{ include "name" . }}
+  verbs:
   - patch
   - update
+  - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

charts/gardener-extension-admission-acl/charts/runtime/templates/deployment.yaml

@@ -44,6 +44,9 @@ spec:
         - --webhook-config-mode=service
         {{- end }}
         - --webhook-config-namespace={{ .Release.Namespace }}
+        {{- if .Values.gardener.virtualCluster.namespace }}
+        - --webhook-config-owner-namespace={{ .Values.gardener.virtualCluster.namespace }}
+        {{- end }}
         {{- if .Values.kubeconfig }}
         - --kubeconfig=/etc/gardener-extension-admission-acl/kubeconfig/kubeconfig
         {{- end }}