apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: spire:server
  labels:
    chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
    release: "{{ $.Release.Name }}"
    heritage: "{{ $.Release.Service }}"
rules:
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - nodes
      - pods
    verbs:
      - get
