Repository: gardener/gardener-extension-registry-cache
Pull request #393: Restrict RBAC permissions
Author: login: dimitar-kostadinov
Labels: name: cla: yes
description: Indicates the PR's author has signed the cla-assistant.io CLA.
name: size/M
description: Denotes a PR that changes 30-99 lines, ignoring generated files.
name: area/security
description: Security related
name: lgtm
description: Indicates that a PR is ready to be merged.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: kind/enhancement
description: Enhancement, improvement, extension
Created: 2025-04-16T11:30:06Z | Merged: 2025-04-25T09:18:27Z

**How to categorize this PR?**
<!--
Please select area, kind, and priority for this pull request. This helps the community categorizing it.
Replace below TODOs or exchange the existing identifiers with those that fit best in your opinion.
If multiple identifiers make sense you can also state the commands multiple times, e.g.
  /area control-plane
  /area auto-scaling
  ...

"/area" identifiers:     audit-logging|auto-scaling|backup|compliance|control-plane-migration|control-plane|cost|delivery|dev-productivity|disaster-recovery|documentation|high-availability|logging|metering|monitoring|networking|open-source|ops-productivity|os|performance|quality|robustness|scalability|security|storage|testing|usability|user-management
"/kind" identifiers:     api-change|bug|cleanup|discussion|enhancement|epic|flake|impediment|poc|post-mortem|question|regression|task|technical-debt|test

For Gardener Enhancement Proposals (GEPs), please check the following [documentation](https://github.com/gardener/gardener/tree/master/docs/proposals/README.md) before submitting this pull request.
-->
/area security
/kind enhancement

**What this PR does / why we need it**:
Restrict RBAC permissions to minimal required for the registry-cache extension.

**Which issue(s) this PR fixes**:
Fixes #

**Special notes for your reviewer**:
N/A

**Release note**:
<!--
Write your release note:
1. Enter your release note in the below block.
2. If no release note is required, just write "NONE" within the block.

Format of block header: <category> <target_group>
Possible values:
- category:       breaking|noteworthy|feature|bugfix|doc|other
- target_group:   user|operator|developer|dependency
-->
```other operator
The RBAC is now restricted to specific resource instances.
```



Diff:
diff --git a/charts/admission/charts/application/templates/rbac.yaml b/charts/admission/charts/application/templates/rbac.yaml
index 32511252..458c9437 100644
--- a/charts/admission/charts/application/templates/rbac.yaml
+++ b/charts/admission/charts/application/templates/rbac.yaml
@@ -29,6 +29,13 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  resourceNames:
+  - {{ include "name" . }}
+  verbs:
   - patch
   - update
 ---
diff --git a/charts/admission/charts/runtime/templates/rbac.yaml b/charts/admission/charts/runtime/templates/rbac.yaml
index 986e0061..7ccd92a9 100644
--- a/charts/admission/charts/runtime/templates/rbac.yaml
+++ b/charts/admission/charts/runtime/templates/rbac.yaml
@@ -22,6 +22,7 @@ rules:
   - leases
   verbs:
   - create
+  - get
   - list
   - watch
 - apiGroups:
@@ -31,8 +32,8 @@ rules:
   resourceNames:
   - {{ include "leaderelectionid" . }}
   verbs:
+  - patch
   - update
-  - get
 - apiGroups:
   - ""
   - events.k8s.io
diff --git a/charts/gardener-extension-registry-cache/templates/clusterrole.yaml b/charts/gardener-extension-registry-cache/templates/clusterrole.yaml
index 26cd7239..931d79dc 100644
--- a/charts/gardener-extension-registry-cache/templates/clusterrole.yaml
+++ b/charts/gardener-extension-registry-cache/templates/clusterrole.yaml
@@ -20,11 +20,19 @@ rules:
   - extensions.gardener.cloud
   resources:
   - extensions
-  - extensions/status
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - extensions
+  - extensions/status
+  resourceNames:
+  - registry-cache
+  - registry-mirror
+  verbs:
   - patch
   - update
 - apiGroups:
@@ -32,21 +40,36 @@ rules:
   resources:
   - mutatingwebhookconfigurations
   verbs:
+  - create
   - get
   - list
   - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  resourceNames:
+  - {{ include "name" . }}
+  verbs:
   - update
-  - create
   - patch
 - apiGroups:
   - resources.gardener.cloud
   resources:
   - managedresources
   verbs:
+  - create
   - get
   - list
   - watch
-  - create
+- apiGroups:
+  - resources.gardener.cloud
+  resources:
+  - managedresources
+  resourceNames:
+  - extension-registry-cache
+  - extension-registry-cache-services
+  verbs:
   - update
   - patch
   - delete
@@ -62,10 +85,10 @@ rules:
   resources:
   - secrets
   verbs:
+  - create
   - get
   - list
   - watch
-  - create
   - update
   - patch
   - delete
@@ -79,13 +102,13 @@ rules:
   - ""
   resources:
   - configmaps
+  resourceNames:
+  - registry-cache-dashboards
   verbs:
   - get
   - update
   - patch
   - delete
-  resourceNames:
-  - registry-cache-dashboards
 - apiGroups:
   - ""
   resources:
@@ -107,10 +130,18 @@ rules:
   - scrapeconfigs
   - prometheusrules
   verbs:
+  - create
   - get
   - list
   - watch
-  - create
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - scrapeconfigs
+  - prometheusrules
+  resourceNames:
+  - shoot-registry-cache
+  verbs:
   - update
   - patch
-  - delete
\ No newline at end of file
+  - delete
diff --git a/charts/gardener-extension-registry-cache/templates/role.yaml b/charts/gardener-extension-registry-cache/templates/role.yaml
index 6cf6f3b7..01551a0e 100644
--- a/charts/gardener-extension-registry-cache/templates/role.yaml
+++ b/charts/gardener-extension-registry-cache/templates/role.yaml
@@ -11,6 +11,7 @@ metadata:
 rules:
 - apiGroups:
   - ""
+  - events.k8s.io
   resources:
   - events
   verbs:
@@ -23,6 +24,7 @@ rules:
   - leases
   verbs:
   - create
+  - get
   - list
   - watch
 - apiGroups:
@@ -34,4 +36,4 @@ rules:
   - gardener-extension-heartbeat
   verbs:
   - update
-  - get
+  - patch
diff --git a/example/controller-registration.yaml b/example/controller-registration.yaml
index 493f9198..54da372f 100644
--- a/example/controller-registration.yaml
+++ b/example/controller-registration.yaml
@@ -4,7 +4,7 @@ kind: ControllerDeployment
 metadata:
   name: extension-registry-cache
 helm:
-  rawChart: H4sIAAAAAAAAA+0da3PbuDGf+StQ5W4u6YTU2045k5n6bF3iaWJrbNdt56bjgUhYwpkiWJCUo7ukv70LgG9Roii7cnzHnYwsgcBiAewudhcLZoq5TVzCdfI5IK5PmatzMqV+wJe6ha0Zab94MHQADodD+Reg+Fd+7/YH3d6wd3AgyrsHvYP+CzR8eNfVEPoB5gi94IwFm+pVPX+mMK1cf2NGnDmduoyTHfsQC3wwGKxdf1j2/Pr3OoNe5wXqPOpI18AffP1fojEOAsJdHwUMqWVG9zPioklIHZu6U+Rh6w5PiW9oL9HVjPrIDz2P8QC+AGs4aOqwCZrjwJpB7TeIEwcHdEGgXTDLlGPXBgQumcJT5qJXHie39DOx0T2Fen96baBz11ki5sqWgiTkEY4c6hJDM04uby4DoA1QHLP5HBBcH18im3JfM6Y0aMtPRb5mTH7lbfkZF8ymbfER//QXbjtFNIHxhR66pQ7xtT8b/r0HnxN8B5/BHL7/F6peY05Z6KPTkxF06HH2C7ECzaA2wW1VD4o0Y+FbzCZt7alXdXuolv/jGeaBscRzZ9c+quS/1x8W5b/XbeR/L4A9ek24WHcTLboa9rzkZ6trdFqaTXyLUy+QRUfoA2wGyBIsgW4ZR8GMoPcRC6GLiHHQsWAclHCUobl4TkxUyWvaIu67Y0Dnz0iMni1Uy7/NLGPKHtJHlfwf9ov232F/eNjI/z6g3UaX45N/6j/B7nfMvCVsmbPgCpjBRKCFB+jyaIwuRwhEHbvyB76FjZLigCCLzT3sLsXGnuoAi7kBp5MQ9mpfa7e1GP9HagF7Ef0UqgX0lhIO2sQTDKb3QNKh3pSZU4FCoPZnSLdQa4Lhy3fvjy5ORmeji5sPR8d/uzk5vWjH9XTZG3Mc4N+Ia6VxYUCzdfyMDPTdKwsHyDDa8O96dHF5en72OvpJPuO555D2OsRiG0SjGLVZQF3yYE45Z7wlBgiWljSkIvVJXDwBiwPlxq0sK6lao0JhgQktazHOweZAKWUoR5nmZbFvrTqr5T8gMCNAnL+zJ1jb/wPOO+g2/t8+oM7634C5Dya5bwReLVuwQv93u4Pi+veGh43+3wv89puObHDEwOtqCSuthfSvX7VqS020I6D4RW0tiwT00y2dKjRZ41KVGzEaI8HsG3FvhuWw0G4vutjxZrir3VHXNsFLEw1DpeaSfovdOgTbBFxPUJFQjdqKgHXk66q6HtdfHU6CmM5BqSpsCIkn9BYZ19gJwSGWz2BIt8njkkdJQ+L4JI9nhv2x9IJRy5/h3vDAbBUQBHiaIvA4dYNb1Pre/+v3frEmJx7zKWy7y00oJA0lCM2dEaq1SH+IAWYePDV/N7AZ6uh/ywFlScCecUiteECF/u/3u4cF/d8fdgeN/t8H6LqeU9N8gi0Dh8GMcfqrsizv3oLkM1DLsUJWbHABbKDNSYBtHGATNMC2Tj5CDp6AIhJtEMKeZ9yFE8JdEhDZ0fZ4EBKxabD229Lo3bbRapfUBS5wLehWqPAL2BawT4wzIEToMB6CnW5qOjSk7zkLPUm6jtZuYfCUE5+F3CJR1Uh0fPixIHwSlU5JIP86QKH8ci+ipQ/qKK1a+NmGEQbhdgSIb17yLfRghckqVdieU1/gzvkhiltWCZuHgXRm7slkxtidld3Vt6cqokVOKSfxV6982hIKKmdtjl3Y2eykdGt6MkRkSEvnzgZWCkTQ+ur85PyVTecUtI1+x2AxbOqyxWsTXZA5WxDp44FUsHsk2E16gEWqoiUEFxxYCX3CS+GiD43HHHgpl6yZ3lZrFZ9PYEaCR5+/rfpWLDXHXqH7qI8H4YiHsInIFJlQHMlS5OxOG/uzCYNF8bejR+hCHzz7LVlyBafFGAdG2yyaUtsVOqhCPAcjG2xDEGjDYpwwH/7MS/jB4tgjalaVRvI4g01jRkJfqtVH5pSn3k6fHexo/03AEhBrv5UZWOX/d7rdgv037PQb+28v8DD770fFBn8QMxAGfEFuBb2xMtwwX1Br1Vzefnb8cCKOmKXZqfBcEr6gFjmyLBa6Qa2JTnaR1YHJ4sZR/8NCLf2vQni1UwEqz/8PesX4L/xo9P8+oHD+nw25fsJeiWJ/oJqJkWV4yURfdKmQZVTUBSvDzsSRDfQFuUAVcQM0aBTVY0N9+QfnSJeB4AXsT4zr4Lzye06D9THBKvkfHhbzfw4Hg4NG/vcBZSca13Jhz+N1RYWTnK3UBCiARJTVuZIBeMoZZ0vVsZ3BWN7xTgZfPCJJtH+TZ3TQWho0Cti/RErAxvn7grL669s6HKkj/zbxHLacw0jq2QCb5b/b6R8Wz3/7/V4j/3uBov8HMuKnrt5JsuI7uniPJ9ffkCMoO6LTmY4XmALt1KHBUk8OuMtjr+1g6QE+H7w4wjXfI5Ypw2ULKsj6ADQxvvwoAsQm6sknnkMt7JvZU+Wo8Fh4gIoSXx5hM64mT2Zbf8zM5kPnc5fJiRVGRFKGbyQ+12WBivrHRWANzoh154fztoofZ/O61LTm9XrWNlQH59A2XpnEkqze1Va6Ty2cdFZKt6wcPa/kOTr6zriKRm78CDMyFunvra2MptbrzUNJDtlLRwczzKnlGyqh7FJEXEXSWKZBGnNN179VsnitNS1UFBfaBDwk6yqJxLUIbYEwmdKWxb4yJifHsg9n2t1kWgBUv2f8TsQ2i/LLdA5iR+dEhwlWcgz60nHYPbG3a28Dz29qsV53MB2a6f4MNiFfF+NKadADy9MHg34ec6xg1DpRBry2PHaw75/lJ9Jf+iCv+l86naiynwszndWadiG2mELFZCn1GnuFAikleXGPUnCM7DrJsnHoOGMGGnFprubeeMnDbDvMpxk+05EeKZh3bRJY7YLpk3FSc03m+LNoZoWcw9YIIxE/xPWRdxkqUh3mp8lORtrsculafpY0gXlGYN+aEBzoyc75bt3Gida0BOTkXgeNBCuJgWkEdfZa0pJ2hmx3GjW7VK1WurGpL7RMRkPnMEePj9OnoNd+YdRFrTet4mDVdRydeUQdA+vp3rCOWtXkPG5xlDQo4i4keOnUfpdlqdV0MaOIITqojvhji/XY1DqSKl2owuzYomrKkzKiWmOlL6vwwfCq0RFexLZm9/BKOo2e6eK0R8e2OCb235nrNfymTSviUSeYrUennpcNP9Ef0Q2R7KATXRk9y7Yl7iIr7UoZfRwdnYwubkYfR8dXp+dnN2dHn0aX46PjUVIToYXA/RNscGamEKFbShw7OgRYKRc7vpkYPEbCMbuaJTG9p5+O3o+ugdjzi5vz69HFPy5Or1ZoNZEyejN+arvUcd20SKArQrlTgMiJOwCZTuTmMuZ0AXpuSka+hR2sLgXdYsdPx+jQBSyG7485m5AsglkQeO9JkJ85T05ZWy38r/lH0p6o5A5JNihrMVEfrq7GmQfUpQHFzglx8DLSZybqdpIanIgkjLq0ilbLvZA61LId+KuMHCuFyKlI0SUb8bhI2TYaQlp2AbOYY6Kr4/E69k2slWzbzPn/anQkbfEFgeKYp5GRbqdCfSyYE87JJ2GTlEyE0oqZAcxFRSWPJRt7pqJYTXHv1ETCtn2opFZ4DWsIXJHb7ejLzZCanxW7qzAxVhyxy3J2ZVy/9oTUnY4NZJWE8zaEEWOwyS0OneATswHFoNfJDOLbCb19E1An/ucxG+w7HsrLoJPQnpLtAoFV8f/Dlfu/w96wuf+7F8jG/jzpLaXRvzGzT5L1/lGu9zMJA9b1/mNvGRy7v7tRVM+But1vM8IWusrAWMIKjcBjEOsT+8FHzj1e+kfCWttGydWR/9qJ/xFU5X/1Dory3+s25//7gR3yvx6Q+P+7PA5Ydz2gLJ8XjBa3mB69KbP18RJ6M708btJwSdLzVpEWvWw5kmhUnvjMvIhN6KmF5ncEdfV/rcTfCCrzfwfF/N/+AEzCRv/vAXbU/w9L/P19bgO7pQc3ecENPCHU0f/R8URtF6BC//f6neL9395Bp3n/w16gNLEvUin/V+2+kgeyzTn4LWdzHWo5th4wXUXF0Q8//9aKA9Yts3V1PG69aYlnLXO7wPfXf/9QjwJ5Fk+IravECB04CMxSX48O4HOEFekoHJm9KZJeh5hkpvU4SBH1molSQOet/DaWO6CCXhXSVq1p8Jity/056Tk9IIVpoCJvKXcV+Zlt5nFASCVtRVd4Tscr4aD9hqmSg6AaGUBxLD6qI/tdOa8qO8fNnwHlDhw2nD+toK484V49a1LiVOvo6qnV6LOFHfZ/rCzN7c2Ayvz/XnH/H3QPmvzfvUDR/yvaALFb0Th6iRYGd47J49v8FF2xO5JkQzz1sm4NdeR/4eGd3gNcFf856BXjP93Dfr+R/31AwZIQS6ysCLtw60dwvUj6EWZhMSIElQIKz8bMPoqqgTmwg8rQof8t1UZsoZUMILZas9mf+TKlazJZMlBI4+wJPX1QL/1VkCJfZr6eGGNO3SPlJaTpEmmZHG+cNJO5+Pg2rbyS+bFVr/jzaq9J2a69bpz2NG3TVnXStsUnOSuvFqbSN9CpSwjShkwy9cquuIjylWsuaebJNquuziWyPKVKVOJJYVTZykZa72nvhFXr/4UawQNeAF8V/+l2ive/O4NBt9H/+wCVbg+s+xJU5C047SFnHtFtZt2Bs+/dTQ2bLNoJl0T/80HbCyfAxkl5O/OesTz7mNJ0CKQGjt8n+fi9SIGfmijpzMvcDDi9PWPBGHSKkG8te4VKJHhoL8GlD8SbyXz10i3lCr9BxJga6v1FwpeeLJGM+KR3XrSoppi8vOOd5Oq9jBPRYqxCyD0mLgtRN/Mm5/hiiRb7z287bzuC1MyJKyf/ATGMkx8tLzTRsDNXOSlkLmf1YPCJaqBpUorshJSy/S+z78R7QoSp3wNM5ar6IqJDJCVWasCWMAdampbmw8qxwaxnkvolucmbs+Nus7ckVCpscjZsqisJZfcVgPSOeLr2nkBsoGu5aIKpJRdfFJGDQT8qinNou+KtRJq2esHBRD//W9PKEiJhB/gquUDlYSspS6MnMQtHxdCdXKGLjJxMYV8PJ+LVWm1b1BUvVodB5H4kzXcQMK4sK7/d53Z7hR4pUq2+0RH/D0TyTmBTHc1H/0dE6/m4Og000EADDTTQQAMNNNBAA39o+B9O2OZqAHgAAA==
+  rawChart: H4sIAAAAAAAAA+0da2/bOLKf9St47i62PVTyM0nPQIHLJt42uDYxklzuDotFQEu0zY0s6kjJqXfb++03JPWWbVlO12m2HgSJLZLDITkznBkOlQnmDvEIN8nHgHiCMs/kZEJFwBemje0paT57MLQAjg4O1F+A4l/1ud3ttTsHncND+bx92DnsPkMHD++6GkIRYI7QM85YsK5eVfkThUnl+ltT4s7oxGOcbNmHXODDXm/l+sOy59e/0+p1Ws9Q64uOdAV84+v/HA1xEBDuCRQwpJcZ3U+Jh0YhdR3qTZCP7Ts8IcIynqPrKRVIhL7PeAAfgDVcNHHZCM1wYE+h9ivEiYsDOifQLphmnmPPAQQemUAp89ALn5Mx/UgcdE+h3l9eWujCcxeIeaqlJAn5hCOXesQyrNOr26sAaAMUJ2w2AwQ3J1fIoVwY1oQGTfVbk29Yo994U/2OH0wnTfkr/irmXjNFNILxhT4aU5cI46+WuPfh9wjfwe9gBp//B1VvMKcsFOjsdAAd+pz9SuzAsKhDcFPXg0eGNRc2c0jTeOxV3Ryq5f9kinlgLfDM3baPKvnvdA+K8t9p7+V/J4B9ekO4XPc+mrcN7PvJ10bbajUMhwibUz9Qj47RO9gMkC1ZAo0ZR8GUoLcRC6HLiHHQiWQclHCUZXh4RvqokteMedx3y4LOn5AYPVmoln+H2daEPaSPKvk/6hbtv6PuwdFe/ncBzSa6Gp7+2/wJdr8T5i9gy5wG18AMfQRauIeujofoaoBA1LGnvuAxbJQUBwTZbOZjbyE39lQH2MwLOB2FsFcLo9k0YvzvqQ3sRcwzqBbQMSUctIkvGczsgKRDvQnrTyQKiVpMkWmjxgjDh+/eHl+eDs4Hl7fvjk/+cXt6dtmM65mqN+a6wL8R1yrjwoJmq/gZWei7FzYOkGU14edmcHl1dnH+MvpKPuKZ75LmKsRyG0SDGHW/gHpJwYxyznhDDhAsLWVIReqTeHgEFgfKjVtbVkq1Rg+lBSa1rM04B5sDpZShHGWGn8W+seqslv+AwIwAcWJrT7C2/wecd9je+3+7gDrrfwvmPpjkwgr8WrZghf5vt3vF9e8cHO31/07g999N5IAjBl5XQ1ppDWR+/mxUW2qyHQHFL2sbWSSgn8Z0otFkjUv93IrRWAlmYcW9WbbLQqc5b2PXn+K2cUc9pw9emmwYajWX9Fvs1iXYIeB6goqEatTRBKwi39TVzbh+eTgJYjoDpaqxISRL6BhZN9gNwSFWZTCkcVK8pChpSFxB8nimWAyVF4waYoo7B4f9RgFBgCcpAp9TLxijxvfi79+LYk1OfCYobLuLdSgUDUsQ9rdGqNci/SIHmCl4bP7ew3qoo/9tF5QlAXvGJbXiARX6v9cr6f/uQbuz1/+7ANM0c2qaj7Bt4TCYMk5/05bl3WuQfAZqOVbImg0ugQ2MGQmwgwPcBw2wqZOPkItHoIhkG4Sw71t34YhwjwREdbQ5HoRkbBqs/aYyejdtVO6SesAFng3dShV+CdsCFsQ6B0KkDuMh2Ol9w4SG9C1noa9IN9HKLQxKOREs5DaJqkaiI+DLnPBR9HRCAvXXBQrVh3sZLX1QR2nV3XaV/dqEyQxCkWkhZzJqVVqPzCPtLOUJ9xWd8lPoA6eRMsnYmVEhO875Q5pry1TPwkA5VfdkNGXszs5aF4U5szmRHdaZvi9Ly5LpA/6kHnCTk9hrlt5/M3RHE5XOXonMhI7KRZ5hD/Z8J3n64Bl6UNdLJmSNpK8uNAXhc1oaTmni5CcHtEEgzx2uL04vXjh0RmHDMO8YMLlDPTZ/2UeXZMbmRLnpoNjYPZIaQznxxTFEooHwGLQB+oAXMspyYH3JaUqlryRFpV4ajTI+QWBVg9oLXTV/G/WtJWCG/eXd18dRqYBMB4vpiMEcr1CYDx6TlFLh4xKzbSowNmMcGG29JlEbVqGDKsQz8JPAvAf9Y9mMEybgz2wJP9gc+0TPqtb0Pmew709JKNTO+GCV8AUJWbLeAlRrUFYOG4r9Y9tnfzRsaf+PwBKU67WRG1AV/2m12wX7/6DV7e3t/13Aw+z/HzUbfCNuAAz4kowlvbECWzNfUKvsLm0+OyIcyRQD5XZoPFfaZDm2bRZ6Qa2JTrag8sDU432g5puFWvpfh3Brp4JU5n8cdorx/94+/rMbKOR/ZEPuH7C/RLE/UM3EyDK81EefTKWQVVQ8dm7jcwQLfUIeUEW8APX2iupLQ335B8/KVAcBc9ifGDfB8+X3nAarY8JV8n9wVMz/Our1DvfyvwtYdqJ1oxb2Il5XVDjJ20hNLI9TLWecDVXHZgbjygBZfYMvHpEiWtzmGR20lgGNAvYfmRKydv4+oaz++roOx+rIv0N8ly1mMJJ6NsB6+W+3ukel859uZy//O4Gi/wcyIlJX7zRZ8S1dvC8n11+RI6g6opOpieeYAu3UpcHCTBIclgdum8HCB3wy8Ey4IXxi91W8ak4lWe+AJsYX72V0uY86qsR3qY1FP5tVED08kR6gpkSoFAbG9eSpbPv3mdl86HxuMzmxwohIyvCNwud5LNAnHPEjsAanxL4T4aypg8/ZvD49rXm9nrUNdeIEtI1XJrEkq3e1UvephZPOytItK0fPC5VHgb6zrqORWz/CjAzl9YfGRkZT4+X6oSRJFktHBzPMqS0snVB4JaOkMmkw0yCNk6br31iyeI0VLXTkFdoEPCSrKsnExQhtgTCV0pjFXhqTm2PZhzPtdjItAarfM34nY5tF+WUmB7GjM2LCBGs5Bn3puuyeOJu1d4Dn17VYrTuYCc1MFcoWphxXSoMZ2L7Z63XzmGMFo9eJMuC1xYmLhTjPT6RYCJBX82+tVlRZ5MJM57WmXYotplAxWUqzxl6hQUlJXtyjFCwru07q2TB03SEDjbjol3Ov/KQw2w7zSYbPTGRGCuZNkwR2s2D6ZJzUXJMZ/iib2SHnsDXCSOQXeX3oTYaKVIeJNNnNSptdLTxbZEmTmKcE9q0RwYGZ7JxvVm2caEVLQE7uTdBIsJIYmEZS56wkLWlnqXZnUbMr3arUjUOF1DIZDZ3DHBWfpKWg135l1EONV43iYPV1LJP5RB95m+nesIpa3eQibnGcNCjiLiT4mdR5k2WpcrqgVcQQHcpH/LHBeqxrHUmVKVVhdmxRNe1JWVGtodaXVfhgeNXoCC9iW7F7+Es6jcpMedpjYkeeMYs3/dUaft2mFfGoG0xXo9Ply4af6I/ohlB20ImujMqybYk3z0q7VkbvB8eng8vbwfvByfXZxfnt+fGHwdXw+GSQ1ERoLnH/BBtcP/MQoTElrhMdApSeyx2/nxg8VsIx25olMb1nH47fDm6A2IvL24ubweW/Ls+uS7T2kTZ6M35qc6njum6RQFeEaqcAkZN3QDKdqM1lyOkc9NyEDISNXawvhY2xK9IxunQOiyHEkLMRySKYBoH/lgT5mfPVlDX1wv+WL1L2RCV3KLJBWcuJend9PcwUUI8GFLunxMWLSJ/1UbuV1OBEZnDUpVW2WuyE1AMj24EoM3KsFCKnIkWXbMTDImWbaAhl2QXMZm4fXZ8MV7FvYq1k22bO7MvRkbTFJwSKY5ZGRtqtCvUxZ244Ix+kTbJkIrRWzAxgJitqeVyysWcqytWU9477SNq2D5XUCq9hBYElud2MvtwM6fkp2V2FibHjiF2Wsyvj+rUnpO50rCFrSThvTRgxBoeMcegGH5gDKHqdVmYQX0/o7auAOvE/nzlg3/FQXQYehc6EbBYIrIr/H5Xufx90Dvb3v3cC2difr7ylNPo3ZM5pst4/qvV+ImHAut5/7C2DY/dPL4rquVC3/XVG2EJPGxgLWKEBeAxyfWI/+Ni9xwtxLK21TZRcHfmvffEjgqr8r26nmP/Vabe6e/nfBWyR//WAix9/yuOAVddDVDIwGBzgDwViZeauLjZW5dBW5/JvnR+8RaZuvb4qri+sjMGYyxYqiVMZ63N3H1ugnhjU1f+1En8jqMz/7RX1f7cHJuFe/+8AttT/D0v8/XNuA9ulB+/zgvfwiFBH/0fHE7VdgAr93+m2jor2/2Fr//6PncDSxL5Ipfyh2r2UB7LJOfiYs5kJtVzHDJipo+Loh59/b8QB60a/cX0ybLxqyLJGf7PA9+dffqhHgTqLJ8QxdWKECRwEFrQwowP4HGFFOgpHZq+KpNchJplpMw5SRL1mohTQeSO/jeUOqKBXjbRRaxp85phqf056Tg9IYRqozFvK3Q9/Ypt5HBDSSVvRFZ6zYSkctNswVXIQVCMDKI7FR3VUv6XzqmXnuPkzoNyBw5rzpxLqyhPu8lmTFqdaR1ePrUafLGyx/2NtaW5uBlTm/3eK+3+vfbjP/90JFP2/og0QuxV7Ry/RwuDOMXV8m5+ia3ZHkmyIx17WjaGO/M99vNV7oKviP4el+H/7qLuP/+8ECpaEXGJtRTiFWz+S62XSjzQLixEhqBRQKBsy5ziqBubAFirDhP43VBuxhbZkALHVms3+zD/TuiaTJQMPaZw9YaYF9dJfJSnqZfaribFm1DvWXkKaLpE+U+ONk2YyFx9fp5VLmR8b9Yo/lntNnm3b69ppT9M2HV0nbVssyVl5tTAtfQOhvoSgbMgkU2/ZFRf5vHTNJc082WTV9elDlqf0E514UhhVtrKV1nvcO2HV+n+uR/CAfwBQFf9pt4r3v1u9Xnuv/3cBOt0eWPc5qMgxOO0hZz4xHWbfgbPv300sh8ybCZdE//mi6YcjYOPkeTPz8rc8+/SV6RAoDRy/T/TL96IEftJHSWd+5mbA2ficBUPQKVK+jewVKpngYTwHlz6Qb2ET+o1d2hV+hYg1sfQ7h6QvPVogFfFJ77wYUU05eXnHO8nVex4nosVYpZD7TF4Wol7mTd7xxRIj9p9ft163JKmZc1VO/gtiGCc/2n7YRwetmc5JITM1q4e9D9QATZNS5CSkLNv/MvtOvCdEmLodwLRcVV9GdMikxEoN2JDmQMMw0nxYNTaY9UxSvyI3eXN63G32loROhU1OgPv6SsKy+wpAekuWrrwnEBvoRi6a0DeSiy+ayF6vGz2Kc2jb8q1EhlG+4NBHP/9iGMsSImEH+Ky4QOdhaylLoycxC0ePoTu1QpcZOZnAvh6O5Ouwmo6sK1+sD4PIfUmabyFgXFtWotnlTrNEjxKpRtdqyf8DkrwTuq8P4KP/EdJ4Oq7OHvawhz3sYQ972MMe9vDNw/8BU4+2cAB4AAA=
   values:
     image:
       tag: v0.16.0-dev


Reviews:
user: login: ialidzhikov
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-16T11:38:44Z
user: login: plkokanov
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-16T12:08:26Z
user: login: dimitar-kostadinov
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-17T09:44:59Z
user: login: ialidzhikov
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-22T12:52:22Z
user: login: ialidzhikov
body: The full diff from the inline cosmetic suggestions

```diff
diff --git a/charts/admission/charts/runtime/templates/rbac.yaml b/charts/admission/charts/runtime/templates/rbac.yaml
index 986e0061..7ccd92a9 100644
--- a/charts/admission/charts/runtime/templates/rbac.yaml
+++ b/charts/admission/charts/runtime/templates/rbac.yaml
@@ -22,6 +22,7 @@ rules:
   - leases
   verbs:
   - create
+  - get
   - list
   - watch
 - apiGroups:
@@ -31,8 +32,8 @@ rules:
   resourceNames:
   - {{ include "leaderelectionid" . }}
   verbs:
+  - patch
   - update
-  - get
 - apiGroups:
   - ""
   - events.k8s.io
diff --git a/charts/gardener-extension-registry-cache/templates/clusterrole.yaml b/charts/gardener-extension-registry-cache/templates/clusterrole.yaml
index 050c59a0..931d79dc 100644
--- a/charts/gardener-extension-registry-cache/templates/clusterrole.yaml
+++ b/charts/gardener-extension-registry-cache/templates/clusterrole.yaml
@@ -40,10 +40,10 @@ rules:
   resources:
   - mutatingwebhookconfigurations
   verbs:
+  - create
   - get
   - list
   - watch
-  - create 
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
@@ -58,10 +58,10 @@ rules:
   resources:
   - managedresources
   verbs:
+  - create
   - get
   - list
   - watch
-  - create
 - apiGroups:
   - resources.gardener.cloud
   resources:
@@ -85,10 +85,10 @@ rules:
   resources:
   - secrets
   verbs:
+  - create
   - get
   - list
   - watch
-  - create
   - update
   - patch
   - delete
@@ -130,10 +130,10 @@ rules:
   - scrapeconfigs
   - prometheusrules
   verbs:
+  - create
   - get
   - list
   - watch
-  - create
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -144,4 +144,4 @@ rules:
   verbs:
   - update
   - patch
-  - delete
\ No newline at end of file
+  - delete
diff --git a/example/controller-registration.yaml b/example/controller-registration.yaml
index d29846ce..54da372f 100644
--- a/example/controller-registration.yaml
+++ b/example/controller-registration.yaml
@@ -4,7 +4,7 @@ kind: ControllerDeployment
 metadata:
   name: extension-registry-cache
 helm:
-  rawChart: H4sIAAAAAAAAA+0da2/bOLKf9St47i62PVTyM0nPQIHLJt42uDYxklzuDotFQEu0zY0s6kjJqXfb++03JPWWbVlO6zS7HgSJLZLDITkznBkOlQnmDvEIN8nHgHiCMs/kZEJFwBemje0paT57MLQAjg4O1F+A4l/1ud3ttTsHncND+bx92DnsPkMHD++6GkIRYI7QM85YsK5eVfkThUnl+ltT4s7oxGOcbNmHXODDXm/l+sOy59e/0+p1Ws9Q64uOdAX8ydf/ORriICDcEyhgSC8zup8SD41C6jrUmyAf23d4QoRlPEfXUyqQCH2f8QA+AGu4aOKyEZrhwJ5C7VeIExcHdE6gXTDNPMeeAwg8MoFS5qEXPidj+pE46J5Cvb+8tNCF5y4Q81RLSRLyCUcu9YhlWKdXt1cB0AYoTthsBghuTq6QQ7kwrAkNmuq3Jt+wRr/xpvodP5hOmvJX/FXMvWaKaATjC300pi4Rxl8tce/D7xG+g9/BDD7/D6reYE5ZKNDZ6QA69Dn7ldiBYVGH4KauB48May5s5pCm8dirujlUy//JFPPAWuCZu20fVfLf6R4U5b/T3sv/TgD79IZwue59NG8b2PeTr4221WoYDhE2p36gHh2jd7AZIFuyBBozjoIpQW8jFkKXEeOgE8k4KOEoy/DwjPRRJa8Z87jvlgWdPyExerJQLf8Os60Je0gfVfJ/1C3af0fdg6O9/O8Cmk10NTz9t/kT7H4nzF/AljkNroEZ+gi0cA9dHQ/R1QCBqGNPfcFj2CgpDgiy2czH3kJu7KkOsJkXcDoKYa8WRrNpxPjfUxvYi5hnUC2gY0o4aBNfMpjZAUmHehPWn0gUErWYItNGjRGGD9+9Pb48HZwPLm/fHZ/84/b07LIZ1zNVb8x1gX8jrlXGhQXNVvEzstB3L2wcIMtqws/N4PLq7OL8ZfSVfMQz3yXNVYjlNogGMep+AfWSghnlnPGGHCBYWsqQitQn8fAILA6UG7e2rJRqjR5KC0xqWZtxDjYHSilDOcoMP4t9Y9VZLf8BgRkB4sTWnmBt/w8477C99/92AXXW/xbMfTDJhRX4tWzBCv3fbveK6985ONrr/53A77+byAFHDLyuhrTSGsj8/NmottRkOwKKX9Y2skhAP43pRKPJGpf6uRWjsRLMwop7s2yXhU5z3sauP8Vt4456Th+8NNkw1Gou6bfYrUuwQ8D1BBUJ1aijCVhFvqmrm3H98nASxHQGSlVjQ0iW0DGybrAbgkOsymBI46R4SVHSkLiC5PFMsRgqLxg1xBR3Dg77jQKCAE9SBD6nXjBGje/F378XxZqc+ExQ2HYX61AoGpYg7G+NUK9F+kUOMFPw2Py9h/VQR//bLihLAvaMS2rFAyr0f69X0v/dg3Znr/93AaZp5tQ0H2HbwmEwZZz+pi3Lu9cg+QzUcqyQNRtcAhsYMxJgBwe4DxpgUycfIRePQBHJNghh37fuwhHhHgmI6mhzPAjJ2DRY+01l9G7aqNwl9YALPBu6lSr8ErYFLIh1DoRIHcZDsNP7hgkN6VvOQl+RbqKVWxiUciJYyG0SVY1ER8CXOeGj6OmEBOqvCxSqD/cyWvqgjtKqu+0q+7UJkxmEItNCzmTUqrQemUfaWcoT7is65afQB04jZZKxM6NCdpzzhzTXlqmehYFyqu7JaMrYnZ21LjabM7WenEh/7WsTs2T+gEGpB+zkJAabpTfgDOHRTKXTVyIzoaNylWfYg03fSZ7WnKIv3PWSCVkj6qsLTUH4nJaGU5o4+ckBdRDIg4fri9OLFw6dUdgxzDsGXO5Qj81f9tElmbE5UX46aDZ2j6TKUF58cQyRbCA8BnWAPuCFDLMcWF9ymlLxK4lRqZdGo4xPEFi6oPZCV83fRn1rCZhhv9D9KmaqxFGpgUwHi+mIwRyvGPGDxySlVPh4U9kp4bQZ48Bo6zWJ2rEKHVQhnoGjBPY96B/LZpwwAX9mS/jB5tgnela1qvc5g41/SkKhtsYHq4QvSMiS9RagWoOycthM7B/bPvvasKX9PwJLUC7XRm5AVfyn1W4X7P+DVre3t/93AQ+z/3/UbPAncQNgwJdkLOmN9dea+YJaZXdp89kR4UimGCi3Q+O50hbLsW2z0AtqTXSyA5UHph7vAzV/Wqil/3UIt3YqSGX+x2GnGP/v7eM/u4FC/kc25P4B+0sU+wPVTIwsw0t99MlUCllFxWPfNj5HsNAn5AFVxAtQb6+ovjTUl39wrEx1EDCH/YlxExxffs9psDomXCX/B0fF/K+jXu9wL/+7gGUnWjdqYS/idUWFk7yN1MTyMNVyxtlQdWxmMK6Mj9U3+OIRKaLFbZ7RQWsZ0Chg/5EpIWvn7xPK6q9v63Csjvw7xHfZYgYjqWcDrJf/dqt7VDr/6Xb28r8TKPp/ICMidfVOkxXf0sX7cnL9DTmCqiM6mZp4jinQTl0aLMwkwWF53LYZLHzAJ+POhBvCJ3ZfhavmVJL1DmhifPFeBpf7qKNKfJfaWPSzWQXRwxPpAWpKhEphYFxPnsq2f5+ZzYfO5zaTEyuMiKQM3yh8nscCfcARPwJrcErsOxHOmjr2nM3r09Oa1+tZ21AnTkDbeGUSS7J6Vyt1n1o46aws3bJy9LxQeRToO+s6Grn1I8zIUF5/aGxkNDVerh9KkmSxdHQww5zawtIJhVcySCqTBjMN0jBpuv6NJYvXWNFCB16hTcBDsqqSTFyM0BYIUymNWeylMbk5ln04024n0xKg+j3jdzK2WZRfZnIQOzojJkywlmPQl67L7omzWXsHeH5di9W6g5nQzFSRbGHKcaU0mIHtm71eN485VjB6nSgDXlucuFiI8/xEioUAeTX/1mpFlUUuzHRea9ql2GIKFZOlNGvsFRqUlOTFPUrBsrLrpJ4NQ9cdMtCIi34598pPCrPtMJ9k+MxEZqRg3jRJYDcLpk/GSc01meGPspkdcg5bI4xEfpHXh95kqEh1mEiT3ay02dXCs0WWNIl5SmDfGhEcmMnO+WbVxolWtATk5N4EjQQriYFpJHXOStKSdpZqdxY1u9KtSt04VEgtk9HQOcxR8UlaCnrtV0Y91HjVKA5WX8cymU/0ibeZ7g2rqNVNLuIWx0mDIu5Cgp9JnTdZliqnC1pFDNGZfMQfG6zHutaRVJlSFWbHFlXTnpQV1RpqfVmFD4ZXjY7wIrYVu4e/pNOozJSnPSZ25BGzeNNfreHXbVoRj7rBdDU6Xb5s+In+iG4IZQed6MqoLNuWePOstGtl9H5wfDq4vB28H5xcn12c354ffxhcDY9PBklNhOYS90+wwfUzDxEaU+I60SFA6bnc8fuJwWMlHLOtWRLTe/bh+O3gBoi9uLy9uBlc/uvy7LpEax9pozfjpzaXOq7rFgl0Rah2ChA5eQck04naXIaczkHPTchA2NjF+lLYGLsiHaNL57AYQgw5G5EsgmkQ+G9JkJ85X01ZUy/8b/kiZU9UcociG5S1nKh319fDTAH1aECxe0pcvIj0WR+1W0kNTmQCR11aZavFTkg9MLIdiDIjx0ohcipSdMlGPCxStomGUJZdwGzm9tH1yXAV+ybWSrZt5si+HB1JW3xCoDhmaWSk3apQH3PmhjPyQdokSyZCa8XMAGayopbHJRt7pqJcTXnvuI+kbftQSa3wGlYQWJLbzejLzZCen5LdVZgYO47YZTm7Mq5fe0LqTscaspaE89aEEWNwyBiHbvCBOYCi12llBvHthN6+CagT//OZA/YdD9Vl4FHoTMhmgcCq+P9R6f73Qedgf/97J5CN/fnKW0qjf0PmnCbr/aNa7ycSBqzr/cfeMjh2//SiqJ4LddvfZoQt9LSBsYAVGoDHINcn9oOP3Xu8EMfSWttEydWR/9oXPyKoyv/qdor5X512q7uX/13AFvlfD7j48Yc8Dlh1PUTlAoPBAf5QIFYm7upiY1m282ap/FunB2d6+TqpyBW3F1bGYMxlC5XEqYz1qbuPLVBPDOrq/1qJvxFU5v/2ivq/2wOTcK//dwBb6v+HJf7+MbeB7dKD93nBe3hEqKP/o+OJ2i5Ahf7vdFtHRfv/sLV//8dOYGliX6RSvqp2L+WBbHIOPuZsZkIt1zEDZuqoOPrh598bccC60W9cnwwbrxqyrNHfLPD9+Zcf6lGgzuIJcUydGGECB4EFLczoAD5HWJGOwpHZqyLpdYhJZtqMgxRRr5koBXTeyG9juQMq6FUjbdSaBp85ptqfk57TA1KYBirzlnL3w5/YZh4HhHTSVnSF52xYCgftNkyVHATVyACKY/FRHdVv6bxq2Tlu/gwod+Cw5vyphLryhLt81qTFqdbR1WOr0ScLW+z/WFuam5sBlfn/neL+32sf7vN/dwJF/69oA8Ruxd7RS7QwuHNMHd/mp+ia3ZEkG+Kxl3VjqCP/cx9v9R7oqvjPYSn+3z7q7uP/O4GCJSGXWFsRTuHWj+R6mfQjzcJiRAgqBRTKhsw5jqqBObCFyjCh/w3VRmyhLRlAbLVmsz/zz7SuyWTJwEMaZ0+YaUG99FdJinqZ/WpirBn1jrWXkKZLpM/UeOOkmczFx9dp5VLmx0a94o/lXpNn2/a6dtrTtE1H10nbFktyVl4tTEvfQKgvISgbMsnUW3bFRT4vXXNJM082WXV9+pDlKf1EJ54URpWtbKX1HvdOWLX+n+sRPOAfAFTFf9qt4v3vVq/X3uv/XYBOtwfWfQ4qcgxOe8iZT0yH2Xfg7Pt3E8sh82bCJdF/vmj64QjYOHnezLz8Lc8+fWU6BEoDx+8T/fK9KIGf9FHSmZ+5GXA2PmfBEHSKlG8je4VKJngYz8GlD+RL2IR+YZd2hV8hYk0s/coh6UuPFkhFfNI7L0ZUU05e3vFOcvWex4loMVYp5D6Tl4Wol3mTd3yxxIj959et1y1JauZclZP/ghjGyY+2H/bRQWumc1LITM3qYe8DNUDTpBQ5CSnL9r/MvhPvCRGmbgcwLVfVlxEdMimxUgM2pDnQMIw0H1aNDWY9k9SvyE3enB53m70loVNhkxPgvr6SsOy+ApDekqUr7wnEBrqRiyb0jeTiiyay1+tGj+Ic2rZ8K5FhlC849NHPvxjGsoRI2AE+Ky7QedhaytLoSczC0WPoTq3QZUZOJrCvhyP5NqymI+vKF+vDIHJfkuZbCBjXlpVodrnTLNGjRKrRtVry/4Ak74Tu6wP46H+ENJ6Oq7OHPexhD3vYwx72sIc9/Onh/4555VEAeAAA
+  rawChart: H4sIAAAAAAAAA+0da2/bOLKf9St47i62PVTyM0nPQIHLJt42uDYxklzuDotFQEu0zY0s6kjJqXfb++03JPWWbVlO12m2HgSJLZLDITkznBkOlQnmDvEIN8nHgHiCMs/kZEJFwBemje0paT57MLQAjg4O1F+A4l/1ud3ttTsHncND+bx92DnsPkMHD++6GkIRYI7QM85YsK5eVfkThUnl+ltT4s7oxGOcbNmHXODDXm/l+sOy59e/0+p1Ws9Q64uOdAV84+v/HA1xEBDuCRQwpJcZ3U+Jh0YhdR3qTZCP7Ts8IcIynqPrKRVIhL7PeAAfgDVcNHHZCM1wYE+h9ivEiYsDOifQLphmnmPPAQQemUAp89ALn5Mx/UgcdE+h3l9eWujCcxeIeaqlJAn5hCOXesQyrNOr26sAaAMUJ2w2AwQ3J1fIoVwY1oQGTfVbk29Yo994U/2OH0wnTfkr/irmXjNFNILxhT4aU5cI46+WuPfh9wjfwe9gBp//B1VvMKcsFOjsdAAd+pz9SuzAsKhDcFPXg0eGNRc2c0jTeOxV3Ryq5f9kinlgLfDM3baPKvnvdA+K8t9p7+V/J4B9ekO4XPc+mrcN7PvJ10bbajUMhwibUz9Qj47RO9gMkC1ZAo0ZR8GUoLcRC6HLiHHQiWQclHCUZXh4RvqokteMedx3y4LOn5AYPVmoln+H2daEPaSPKvk/6hbtv6PuwdFe/ncBzSa6Gp7+2/wJdr8T5i9gy5wG18AMfQRauIeujofoaoBA1LGnvuAxbJQUBwTZbOZjbyE39lQH2MwLOB2FsFcLo9k0YvzvqQ3sRcwzqBbQMSUctIkvGczsgKRDvQnrTyQKiVpMkWmjxgjDh+/eHl+eDs4Hl7fvjk/+cXt6dtmM65mqN+a6wL8R1yrjwoJmq/gZWei7FzYOkGU14edmcHl1dnH+MvpKPuKZ75LmKsRyG0SDGHW/gHpJwYxyznhDDhAsLWVIReqTeHgEFgfKjVtbVkq1Rg+lBSa1rM04B5sDpZShHGWGn8W+seqslv+AwIwAcWJrT7C2/wecd9je+3+7gDrrfwvmPpjkwgr8WrZghf5vt3vF9e8cHO31/07g999N5IAjBl5XQ1ppDWR+/mxUW2qyHQHFL2sbWSSgn8Z0otFkjUv93IrRWAlmYcW9WbbLQqc5b2PXn+K2cUc9pw9emmwYajWX9Fvs1iXYIeB6goqEatTRBKwi39TVzbh+eTgJYjoDpaqxISRL6BhZN9gNwSFWZTCkcVK8pChpSFxB8nimWAyVF4waYoo7B4f9RgFBgCcpAp9TLxijxvfi79+LYk1OfCYobLuLdSgUDUsQ9rdGqNci/SIHmCl4bP7ew3qoo/9tF5QlAXvGJbXiARX6v9cr6f/uQbuz1/+7ANM0c2qaj7Bt4TCYMk5/05bl3WuQfAZqOVbImg0ugQ2MGQmwgwPcBw2wqZOPkItHoIhkG4Sw71t34YhwjwREdbQ5HoRkbBqs/aYyejdtVO6SesAFng3dShV+CdsCFsQ6B0KkDuMh2Ol9w4SG9C1noa9IN9HKLQxKOREs5DaJqkaiI+DLnPBR9HRCAvXXBQrVh3sZLX1QR2nV3XaV/dqEyQxCkWkhZzJqVVqPzCPtLOUJ9xWd8lPoA6eRMsnYmVEhO875Q5pry1TPwkA5VfdkNGXszs5aF4U5szmRHdaZvi9Ly5LpA/6kHnCTk9hrlt5/M3RHE5XOXonMhI7KRZ5hD/Z8J3n64Bl6UNdLJmSNpK8uNAXhc1oaTmni5CcHtEEgzx2uL04vXjh0RmHDMO8YMLlDPTZ/2UeXZMbmRLnpoNjYPZIaQznxxTFEooHwGLQB+oAXMspyYH3JaUqlryRFpV4ajTI+QWBVg9oLXTV/G/WtJWCG/eXd18dRqYBMB4vpiMEcr1CYDx6TlFLh4xKzbSowNmMcGG29JlEbVqGDKsQz8JPAvAf9Y9mMEybgz2wJP9gc+0TPqtb0Pmew709JKNTO+GCV8AUJWbLeAlRrUFYOG4r9Y9tnfzRsaf+PwBKU67WRG1AV/2m12wX7/6DV7e3t/13Aw+z/HzUbfCNuAAz4kowlvbECWzNfUKvsLm0+OyIcyRQD5XZoPFfaZDm2bRZ6Qa2JTrag8sDU432g5puFWvpfh3Brp4JU5n8cdorx/94+/rMbKOR/ZEPuH7C/RLE/UM3EyDK81EefTKWQVVQ8dm7jcwQLfUIeUEW8APX2iupLQ335B8/KVAcBc9ifGDfB8+X3nAarY8JV8n9wVMz/Our1DvfyvwtYdqJ1oxb2Il5XVDjJ20hNLI9TLWecDVXHZgbjygBZfYMvHpEiWtzmGR20lgGNAvYfmRKydv4+oaz++roOx+rIv0N8ly1mMJJ6NsB6+W+3ukel859uZy//O4Gi/wcyIlJX7zRZ8S1dvC8n11+RI6g6opOpieeYAu3UpcHCTBIclgdum8HCB3wy8Ey4IXxi91W8ak4lWe+AJsYX72V0uY86qsR3qY1FP5tVED08kR6gpkSoFAbG9eSpbPv3mdl86HxuMzmxwohIyvCNwud5LNAnHPEjsAanxL4T4aypg8/ZvD49rXm9nrUNdeIEtI1XJrEkq3e1UvephZPOytItK0fPC5VHgb6zrqORWz/CjAzl9YfGRkZT4+X6oSRJFktHBzPMqS0snVB4JaOkMmkw0yCNk6br31iyeI0VLXTkFdoEPCSrKsnExQhtgTCV0pjFXhqTm2PZhzPtdjItAarfM34nY5tF+WUmB7GjM2LCBGs5Bn3puuyeOJu1d4Dn17VYrTuYCc1MFcoWphxXSoMZ2L7Z63XzmGMFo9eJMuC1xYmLhTjPT6RYCJBX82+tVlRZ5MJM57WmXYotplAxWUqzxl6hQUlJXtyjFCwru07q2TB03SEDjbjol3Ov/KQw2w7zSYbPTGRGCuZNkwR2s2D6ZJzUXJMZ/iib2SHnsDXCSOQXeX3oTYaKVIeJNNnNSptdLTxbZEmTmKcE9q0RwYGZ7JxvVm2caEVLQE7uTdBIsJIYmEZS56wkLWlnqXZnUbMr3arUjUOF1DIZDZ3DHBWfpKWg135l1EONV43iYPV1LJP5RB95m+nesIpa3eQibnGcNCjiLiT4mdR5k2WpcrqgVcQQHcpH/LHBeqxrHUmVKVVhdmxRNe1JWVGtodaXVfhgeNXoCC9iW7F7+Es6jcpMedpjYkeeMYs3/dUaft2mFfGoG0xXo9Ply4af6I/ohlB20ImujMqybYk3z0q7VkbvB8eng8vbwfvByfXZxfnt+fGHwdXw+GSQ1ERoLnH/BBtcP/MQoTElrhMdApSeyx2/nxg8VsIx25olMb1nH47fDm6A2IvL24ubweW/Ls+uS7T2kTZ6M35qc6njum6RQFeEaqcAkZN3QDKdqM1lyOkc9NyEDISNXawvhY2xK9IxunQOiyHEkLMRySKYBoH/lgT5mfPVlDX1wv+WL1L2RCV3KLJBWcuJend9PcwUUI8GFLunxMWLSJ/1UbuV1OBEZnDUpVW2WuyE1AMj24EoM3KsFCKnIkWXbMTDImWbaAhl2QXMZm4fXZ8MV7FvYq1k22bO7MvRkbTFJwSKY5ZGRtqtCvUxZ244Ix+kTbJkIrRWzAxgJitqeVyysWcqytWU9477SNq2D5XUCq9hBYElud2MvtwM6fkp2V2FibHjiF2Wsyvj+rUnpO50rCFrSThvTRgxBoeMcegGH5gDKHqdVmYQX0/o7auAOvE/nzlg3/FQXQYehc6EbBYIrIr/H5Xufx90Dvb3v3cC2difr7ylNPo3ZM5pst4/qvV+ImHAut5/7C2DY/dPL4rquVC3/XVG2EJPGxgLWKEBeAxyfWI/+Ni9xwtxLK21TZRcHfmvffEjgqr8r26nmP/Vabe6e/nfBWyR//WAix9/yuOAVddDVDIwGBzgDwViZeauLjZW5dBW5/JvnR+8RaZuvb4qri+sjMGYyxYqiVMZ63N3H1ugnhjU1f+1En8jqMz/7RX1f7cHJuFe/+8AttT/D0v8/XNuA9ulB+/zgvfwiFBH/0fHE7VdgAr93+m2jor2/2Fr//6PncDSxL5Ipfyh2r2UB7LJOfiYs5kJtVzHDJipo+Loh59/b8QB60a/cX0ybLxqyLJGf7PA9+dffqhHgTqLJ8QxdWKECRwEFrQwowP4HGFFOgpHZq+KpNchJplpMw5SRL1mohTQeSO/jeUOqKBXjbRRaxp85phqf056Tg9IYRqozFvK3Q9/Ypt5HBDSSVvRFZ6zYSkctNswVXIQVCMDKI7FR3VUv6XzqmXnuPkzoNyBw5rzpxLqyhPu8lmTFqdaR1ePrUafLGyx/2NtaW5uBlTm/3eK+3+vfbjP/90JFP2/og0QuxV7Ry/RwuDOMXV8m5+ia3ZHkmyIx17WjaGO/M99vNV7oKviP4el+H/7qLuP/+8ECpaEXGJtRTiFWz+S62XSjzQLixEhqBRQKBsy5ziqBubAFirDhP43VBuxhbZkALHVms3+zD/TuiaTJQMPaZw9YaYF9dJfJSnqZfaribFm1DvWXkKaLpE+U+ONk2YyFx9fp5VLmR8b9Yo/lntNnm3b69ppT9M2HV0nbVssyVl5tTAtfQOhvoSgbMgkU2/ZFRf5vHTNJc082WTV9elDlqf0E514UhhVtrKV1nvcO2HV+n+uR/CAfwBQFf9pt4r3v1u9Xnuv/3cBOt0eWPc5qMgxOO0hZz4xHWbfgbPv300sh8ybCZdE//mi6YcjYOPkeTPz8rc8+/SV6RAoDRy/T/TL96IEftJHSWd+5mbA2ficBUPQKVK+jewVKpngYTwHlz6Qb2ET+o1d2hV+hYg1sfQ7h6QvPVogFfFJ77wYUU05eXnHO8nVex4nosVYpZD7TF4Wol7mTd7xxRIj9p9ft163JKmZc1VO/gtiGCc/2n7YRwetmc5JITM1q4e9D9QATZNS5CSkLNv/MvtOvCdEmLodwLRcVV9GdMikxEoN2JDmQMMw0nxYNTaY9UxSvyI3eXN63G32loROhU1OgPv6SsKy+wpAekuWrrwnEBvoRi6a0DeSiy+ayF6vGz2Kc2jb8q1EhlG+4NBHP/9iGMsSImEH+Ky4QOdhaylLoycxC0ePoTu1QpcZOZnAvh6O5Ouwmo6sK1+sD4PIfUmabyFgXFtWotnlTrNEjxKpRtdqyf8DkrwTuq8P4KP/EdJ4Oq7OHvawhz3sYQ972MMe9vDNw/8BU4+2cAB4AAA=
   values:
     image:
       tag: v0.16.0-dev

```

Otherwise lgtm.
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-25T08:13:19Z
user: login: ialidzhikov
body: /lgtm
state: APPROVED
author_association: MEMBER
submitted_at: 2025-04-25T08:57:46Z

Review comments:
diff_hunk: @@ -22,31 +22,54 @@ rules:
   - extensions
   - extensions/status
   verbs:
-  - get
   - list
   - watch
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - extensions
+  - extensions/status
+  resourceNames:
+  - registry-cache
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: ialidzhikov
body: Don't we need to add `registry-mirror` as well?
created_at: 2025-04-16T11:38:05Z
author_association: MEMBER
diff_hunk: @@ -22,31 +22,54 @@ rules:
   - extensions
   - extensions/status
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: plkokanov
body: ```suggestion
 ```
Do we need to watch/list for `extensions/status`?
created_at: 2025-04-16T12:08:00Z
author_association: NONE
diff_hunk: @@ -22,31 +22,54 @@ rules:
   - extensions
   - extensions/status
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: dimitar-kostadinov
body: Correct, we need watch/list only for `extensions`.
created_at: 2025-04-17T09:44:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -26,9 +26,16 @@ rules:
   - validatingwebhookconfigurations
   verbs:
   - create
-  - get
   - list
   - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  resourceNames:
+  - {{ include "name" . }}
+  verbs:
+  - get
path: charts/admission/charts/application/templates/rbac.yaml
user: login: ialidzhikov
body: I am not sure if it make sense to restrict get requests by resource name because:
- It is confusing. We (or the extension library) use controller-runtime's cached client in most of the cases which does watch/list under the hood. Hence, when you do `client.Get()`, you are not issuing a get requests to the server but the client returns the object from the cache (from the memory). Hence, it is most likely the case that the admission does not issue any get requests at all but relies on the list/watch of the cached client.
- We allow all `validatingwebhookconfigurations` to be listed/watched but we allow get only for particular resource. This does not bring added value as the corresponding ServiceAccount can anyways list all `validatingwebhookconfigurations`.

Hence, I suggest to do not restrict `get`s by resource name. WDYT?
created_at: 2025-04-22T12:50:12Z
author_association: MEMBER
diff_hunk: @@ -20,33 +20,56 @@ rules:
   - extensions.gardener.cloud
   resources:
   - extensions
-  - extensions/status
   verbs:
-  - get
   - list
   - watch
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - extensions
+  - extensions/status
+  resourceNames:
+  - registry-cache
+  - registry-mirror
+  verbs:
+  - get
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: ialidzhikov
body: Same as above for get restricted by `resourceName`.
created_at: 2025-04-22T12:51:11Z
author_association: MEMBER
diff_hunk: @@ -20,33 +20,56 @@ rules:
   - extensions.gardener.cloud
   resources:
   - extensions
-  - extensions/status
   verbs:
-  - get
   - list
   - watch
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - extensions
+  - extensions/status
+  resourceNames:
+  - registry-cache
+  - registry-mirror
+  verbs:
+  - get
   - patch
   - update
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - mutatingwebhookconfigurations
   verbs:
-  - get
   - list
   - watch
+  - create 
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  resourceNames:
+  - {{ include "name" . }}
+  verbs:
+  - get
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: ialidzhikov
body: Same as above for get restricted by `resourceName`.
created_at: 2025-04-22T12:51:21Z
author_association: MEMBER
diff_hunk: @@ -20,33 +20,56 @@ rules:
   - extensions.gardener.cloud
   resources:
   - extensions
-  - extensions/status
   verbs:
-  - get
   - list
   - watch
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - extensions
+  - extensions/status
+  resourceNames:
+  - registry-cache
+  - registry-mirror
+  verbs:
+  - get
   - patch
   - update
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - mutatingwebhookconfigurations
   verbs:
-  - get
   - list
   - watch
+  - create 
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  resourceNames:
+  - {{ include "name" . }}
+  verbs:
+  - get
   - update
-  - create
   - patch
 - apiGroups:
   - resources.gardener.cloud
   resources:
   - managedresources
   verbs:
-  - get
   - list
   - watch
   - create
+- apiGroups:
+  - resources.gardener.cloud
+  resources:
+  - managedresources
+  resourceNames:
+  - extension-registry-cache
+  - extension-registry-cache-services
+  verbs:
+  - get
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: ialidzhikov
body: Same as above for get restricted by `resourceName`.
created_at: 2025-04-22T12:51:31Z
author_association: MEMBER
diff_hunk: @@ -35,8 +43,15 @@ rules:
   - get
   - list
   - watch
+  - create 
path: charts/gardener-extension-registry-cache/templates/clusterrole.yaml
user: login: ialidzhikov
body: Nit 1: There is trailing whitespace at the end.
Nit 2: Can we move create to be the first verb to have identical order of the verbs across the RBAC is the repo?
created_at: 2025-04-25T08:03:24Z
author_association: MEMBER
diff_hunk: @@ -29,6 +29,13 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
path: charts/admission/charts/application/templates/rbac.yaml
user: login: ialidzhikov
body: We could also adapt the admission role in the runtime cluster in the following way:

```diff
diff --git a/charts/admission/charts/runtime/templates/rbac.yaml b/charts/admission/charts/runtime/templates/rbac.yaml
index 986e0061..7ccd92a9 100644
--- a/charts/admission/charts/runtime/templates/rbac.yaml
+++ b/charts/admission/charts/runtime/templates/rbac.yaml
@@ -22,6 +22,7 @@ rules:
   - leases
   verbs:
   - create
+  - get
   - list
   - watch
 - apiGroups:
@@ -31,8 +32,8 @@ rules:
   resourceNames:
   - {{ include "leaderelectionid" . }}
   verbs:
+  - patch
   - update
-  - get
 - apiGroups:
   - ""
   - events.k8s.io
```
created_at: 2025-04-25T08:05:16Z
author_association: MEMBER

PR comments:
user: login: gardener-prow[bot]
created_at: 2025-04-16T11:30:09Z
body: Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with `/test all`
author_association: CONTRIBUTOR
user: login: dimitar-kostadinov
created_at: 2025-04-16T11:31:39Z
body: /test all
author_association: CONTRIBUTOR
user: login: ialidzhikov
created_at: 2025-04-16T11:38:54Z
body: /assign
author_association: MEMBER
user: login: gardener-prow[bot]
created_at: 2025-04-25T08:57:50Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/gardener/gardener-extension-registry-cache/pull/393#pullrequestreview-2793450572" title="LGTM">ialidzhikov</a>*

The full list of commands accepted by this bot can be found [here](https://prow.gardener.cloud/command-help?repo=gardener%2Fgardener-extension-registry-cache).

The pull request process is described [here](https://gardener.cloud/docs/contribute/#pull-request-checklist)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/gardener/gardener-extension-registry-cache/blob/main/OWNERS)~~ [ialidzhikov]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: gardener-prow[bot]
created_at: 2025-04-25T08:57:50Z
body: LGTM label has been added.  <details>Git tree hash: 8914613c2fabebf6097bfa21fdb16683b37bf511</details>
author_association: CONTRIBUTOR