feat(shield): reduce permisison not required if not in openshift

Author: mavimo

charts/shield/Chart.yaml

@@ -13,5 +13,5 @@ maintainers:
   - name: mavimo
     email: marcovito.moscaritolo@sysdig.com
 type: application
-version: 1.49.1
+version: 1.49.2
 appVersion: "1.0.0"

charts/shield/templates/host/clusterrole.yaml

@@ -133,7 +133,7 @@ rules:
     verbs:
       - "use"
 {{- end }}
-{{- if .Values.features.posture.host_posture.enabled }}
+{{- if (and .Values.features.posture.host_posture.enabled (eq (include "common.is_openshift" .) "true")) }}
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -159,7 +159,6 @@ rules:
       - pods/exec
     verbs:
       - create
-{{- if eq (include "common.is_openshift" .) "true" }}
   - apiGroups:
       - security.openshift.io
     resources:
@@ -186,4 +185,3 @@ rules:
       - list
 {{- end }}
 {{- end }}
-{{- end }}

charts/shield/tests/host/clusterrole_test.yaml

@@ -80,14 +80,14 @@ tests:
               - get
               - list
 
-  - it: Adds posture RBAC rules when host_posture is enabled
+  - it: Do not add RBAC rules when host_posture is enabled and OpenShift API is not detected
     set:
       features:
         posture:
           host_posture:
             enabled: true
     asserts:
-      - contains:
+      - notContains:
           path: rules
           content:
             apiGroups:
@@ -96,7 +96,7 @@ tests:
               - clusterrolebindings
             verbs:
               - list
-      - contains:
+      - notContains:
           path: rules
           content:
             apiGroups:
@@ -106,7 +106,7 @@ tests:
             verbs:
               - get
               - list
-      - contains:
+      - notContains:
           path: rules
           content:
             apiGroups:
@@ -115,7 +115,7 @@ tests:
               - secrets
             verbs:
               - get
-      - contains:
+      - notContains:
           path: rules
           content:
             apiGroups:
@@ -174,6 +174,43 @@ tests:
           host_posture:
             enabled: true
     asserts:
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - rbac.authorization.k8s.io
+            resources:
+              - clusterrolebindings
+            verbs:
+              - list
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - flowcontrol.apiserver.k8s.io
+            resources:
+              - flowschemas
+            verbs:
+              - get
+              - list
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - secrets
+            verbs:
+              - get
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - pods/exec
+            verbs:
+              - create
       - contains:
           path: rules
           content:
@@ -217,6 +254,43 @@ tests:
       extra_capabilities_api_versions:
         - security.openshift.io/v1
     asserts:
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - rbac.authorization.k8s.io
+            resources:
+              - clusterrolebindings
+            verbs:
+              - list
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - flowcontrol.apiserver.k8s.io
+            resources:
+              - flowschemas
+            verbs:
+              - get
+              - list
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - secrets
+            verbs:
+              - get
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - pods/exec
+            verbs:
+              - create
       - contains:
           path: rules
           content:
@@ -246,6 +320,34 @@ tests:
       apiVersions:
         - security.openshift.io/v1
     asserts:
+      - notContains:
+          path: rules
+          content:
+            apiGroups:
+              - flowcontrol.apiserver.k8s.io
+            resources:
+              - flowschemas
+            verbs:
+              - get
+              - list
+      - notContains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - secrets
+            verbs:
+              - get
+      - notContains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - pods/exec
+            verbs:
+              - create
       - notContains:
           path: rules
           content: