apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: dedicated-admins-registry-cas-project
  namespace: openshift-config
rules:
# For: https://issues.redhat.com/browse/OSD-3144
# https://docs.openshift.com/container-platform/4.3/builds/setting-up-trusted-ca.html#configmap-adding-ca_setting-up-trusted-ca

# create doesn't work with resourceNames, so grant create for any resources
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create

  # limit CM to just specific resourceNames
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - "*"
  resourceNames:
  # OSD docs will be updated to reflect this name
  - registry-cas
