---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-pipelines-webhook-cluster-access
rules:
  # […]
  - apiGroups: ["policy"]
    resources: ["podsecuritypolicies"]
    resourceNames: ["tekton-pipelines"]
    verbs: ["use"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get"]
    # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources,
    # which requires we can Get the system namespace.
    resourceNames: ["tekton-pipelines"]
  - apiGroups: [""]
    resources: ["namespaces/finalizers"]
    verbs: ["update"]
    # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources,
    # which requires we can update the system namespace finalizers.
    resourceNames: ["tekton-pipelines"]
