fix(core):patch apparmor annotations for cronjobs and updating rbac rules

KubeArmor/core/k8sHandler.go

@@ -230,6 +230,10 @@ func (kh *K8sHandler) PatchResourceWithAppArmorAnnotations(namespaceName, deploy
 	}
 
 	spec := `{"spec":{"template":{"metadata":{"annotations":{"kubearmor-policy":"enabled",`
+	if kind == "CronJob" {
+		spec = `{"spec":{"jobTemplate":{"spec":{"template":{"metadata":{"annotations":{"kubearmor-policy":"enabled",`
+	}
+
 	count := len(appArmorAnnotations)
 
 	for k, v := range appArmorAnnotations {
@@ -246,7 +250,11 @@ func (kh *K8sHandler) PatchResourceWithAppArmorAnnotations(namespaceName, deploy
 		count--
 	}
 
-	spec = spec + `}}}}}`
+	if kind == "CronJob" {
+		spec = spec + `}}}}}}}`
+	} else {
+		spec = spec + `}}}}}`
+	}
 
 	if kind == "StatefulSet" {
 		_, err := kh.K8sClient.AppsV1().StatefulSets(namespaceName).Patch(context.Background(), deploymentName, types.StrategicMergePatchType, []byte(spec), metav1.PatchOptions{})
@@ -292,6 +300,11 @@ func (kh *K8sHandler) PatchResourceWithAppArmorAnnotations(namespaceName, deploy
 		if err != nil {
 			return err
 		}
+	} else if kind == "CronJob" {
+		_, err := kh.K8sClient.BatchV1().CronJobs(namespaceName).Patch(context.Background(), deploymentName, types.StrategicMergePatchType, []byte(spec), metav1.PatchOptions{})
+		if err != nil {
+			return err
+		}
 	} else if kind == "Pod" {
 		// this condition wont be triggered, handled by controller
 		return nil

deployments/get/objects.go

@@ -54,7 +54,7 @@ func GetClusterRole() *rbacv1.ClusterRole {
 			{
 				APIGroups: []string{"batch"},
 				Resources: []string{"jobs", "cronjobs"},
-				Verbs:     []string{"get"},
+				Verbs:     []string{"get", "patch", "list", "watch", "update"},
 			},
 			{
 				APIGroups: []string{"security.kubearmor.com"},
@@ -546,7 +546,6 @@ func GetKubeArmorControllerDeployment(namespace string) *appsv1.Deployment {
 					Labels: KubeArmorControllerLabels,
 				},
 				Spec: corev1.PodSpec{
-					PriorityClassName:  "system-node-critical",
 					ServiceAccountName: KubeArmorControllerServiceAccountName,
 					Volumes: []corev1.Volume{
 						KubeArmorControllerCertVolume,

deployments/helm/KubeArmor/templates/RBAC/roles.yaml

@@ -36,6 +36,10 @@ rules:
   - cronjobs
   verbs:
   - get
+  - patch
+  - list
+  - watch
+  - update
 - apiGroups:
   - security.kubearmor.com
   resources:

deployments/helm/KubeArmorOperator/templates/clusterrole-rbac.yaml

@@ -136,6 +136,10 @@ rules:
   - cronjobs
   verbs:
   - get
+  - patch
+  - list
+  - watch
+  - update
 - apiGroups:
   - security.kubearmor.com
   resources:

deployments/operator/operator.yaml

@@ -377,6 +377,17 @@ rules:
   - list
   - watch
   - update
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  - cronjobs
+  verbs:
+  - get
+  - patch
+  - list
+  - watch
+  - update
 - apiGroups:
   - security.kubearmor.com
   resources:

pkg/KubeArmorOperator/config/rbac/clusterrole.yaml

@@ -130,6 +130,10 @@ rules:
   - cronjobs
   verbs:
   - get
+  - patch
+  - list
+  - watch
+  - update
 - apiGroups:
   - security.kubearmor.com
   resources: