fix: missing permissions for image pull secrets

Signed-off-by: hectorj2f <[email protected]>

charts/cosigned/Chart.yaml

@@ -8,7 +8,7 @@ sources:
 type: application
 
 name: cosigned
-version: v0.1.2
+version: v0.1.3
 appVersion: v1.3.1
 
 maintainers:

charts/cosigned/templates/webhook/clusterrole_webhook.yaml

@@ -25,3 +25,11 @@ rules:
     # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources,
     # which requires we can Get the system namespace.
     resourceNames: [ "{{ .Release.Namespace }}" ]
+
+  # This is needed by k8schain to support fetching pull secrets attached to pod specs
+  # or their service accounts.  If pull secrets aren't used, the "secrets" below can
+  # be safely dropped, but the logic will fetch the service account to check for pull
+  # secrets.
+  - apiGroups: [""]
+    resources: ["serviceaccounts", "secrets"]
+    verbs: ["get"]