apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    labels:
        app.kubernetes.io/instance: kuma
        app.kubernetes.io/name: kuma
    name: kuma-control-plane
rules:
    - apiGroups:
        - ""
      resources:
        - namespaces
        - pods
        - configmaps
        - nodes
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - ""
      resources:
        - services
      verbs:
        - get
        - list
        - watch
        - create
        - update
        - patch
    - apiGroups:
        - ""
      resources:
        - events
      verbs:
        - create
        - patch
    - apiGroups:
        - kuma.io
      resources:
        - dataplanes
        - dataplaneinsights
        - meshes
        - zones
        - zoneinsights
        - zoneingresses
        - zoneingressinsights
        - meshinsights
        - serviceinsights
        - proxytemplates
        - ratelimits
        - trafficpermissions
        - trafficroutes
        - timeouts
        - retries
        - circuitbreakers
      verbs:
        - get
        - list
        - watch
        - create
        - update
        - patch
        - delete
    - apiGroups:
        - kuma.io
      resources:
        - externalservices
        - faultinjections
        - healthchecks
        - trafficlogs
        - traffictraces
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - ""
      resources:
        - pods/finalizers
      verbs:
        - '*'
    - apiGroups:
        - kuma.io
      resources:
        - meshes/finalizers
      verbs:
        - '*'
    - apiGroups:
        - kuma.io
      resources:
        - dataplanes/finalizers
      verbs:
        - '*'
    - apiGroups:
        - authentication.k8s.io
      resources:
        - tokenreviews
      verbs:
        - create
