helm: aggregated clusterrole to view secretproviderclasspodstatuses

Makefile

@@ -413,6 +413,7 @@ e2e-deploy-manifest:
 	kubectl apply -f manifest_staging/deploy/secrets-store.csi.x-k8s.io_secretproviderclasspodstatuses.yaml
 	kubectl apply -f manifest_staging/deploy/role-secretproviderclasses-admin.yaml
 	kubectl apply -f manifest_staging/deploy/role-secretproviderclasses-viewer.yaml
+	kubectl apply -f manifest_staging/deploy/role-secretproviderclasspodstatuses-viewer.yaml
 
 	yq e '(.spec.template.spec.containers[1].image = "$(IMAGE_TAG)") | (.spec.template.spec.containers[1].args as $$x | $$x += "--enable-secret-rotation=true" | $$x[-1] style="double") | (.spec.template.spec.containers[1].args as $$x | $$x += "--rotation-poll-interval=30s" | $$x[-1] style="double")' 'manifest_staging/deploy/secrets-store-csi-driver.yaml' | kubectl apply -f -
 

manifest_staging/charts/secrets-store-csi-driver/templates/role-secretproviderclasspodstatuses-viewer.yaml

@@ -0,0 +1,21 @@
+{{ if .Values.rbac.install }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+{{ include "sscd.labels" . | indent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: secretproviderclasspodstatuses-viewer-role
+rules:
+- apiGroups:
+  - secrets-store.csi.x-k8s.io
+  resources:
+  - secretproviderclasspodstatuses
+  verbs:
+  - get
+  - list
+  - watch
+{{ end }}

manifest_staging/deploy/role-secretproviderclasspodstatuses-viewer.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: secretproviderclasspodstatuses-viewer-role
+rules:
+- apiGroups:
+  - secrets-store.csi.x-k8s.io
+  resources:
+  - secretproviderclasspodstatuses
+  verbs:
+  - get
+  - list
+  - watch

test/bats/e2e-provider.bats

@@ -80,6 +80,9 @@ export VALIDATE_TOKENS_AUDIENCE=$(get_token_requests_audience)
   run kubectl get clusterrole/secretproviderclasses-viewer-role
   assert_success
 
+  run kubectl get clusterrole/secretproviderclasspodstatuses-viewer-role
+  assert_success
+
   run kubectl get clusterrole/secretproviderrotation-role
   assert_success