---
# Scanner identity (R-VULN-09). The whole of its Kubernetes reach is get/list/watch on the objects it
# needs to answer "what is running, and which workload owns it". NO Secret, NO write verb, no
# wildcard. conformance/tests/l0-static/vuln-scanner-supply-chain fails the gate if that changes.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vuln-scanner
  namespace: vuln-scanner
  labels:
    app.kubernetes.io/name: vuln-scanner
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: vuln-scanner-read
  labels:
    app.kubernetes.io/name: vuln-scanner
rules:
  # Running images, their digests, and the nodes a pod sits on (nodes are inventoried as not-covered).
  - apiGroups: [""]
    resources: [pods, nodes]
    verbs: [get, list, watch]
  # The owner chain Pod -> ReplicaSet -> Deployment, and the other two top-level controllers.
  - apiGroups: [apps]
    resources: [replicasets, deployments, statefulsets, daemonsets]
    verbs: [get, list, watch]
  # Pod -> Job -> CronJob, and CronJob templates with no running pod.
  - apiGroups: [batch]
    resources: [jobs, cronjobs]
    verbs: [get, list, watch]
  # KubeVirt VMs are inventoried as not-covered.
  - apiGroups: [kubevirt.io]
    resources: [virtualmachineinstances]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vuln-scanner-read
  labels:
    app.kubernetes.io/name: vuln-scanner
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: vuln-scanner-read
subjects:
  - kind: ServiceAccount
    name: vuln-scanner
    namespace: vuln-scanner