---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ibm-crossplane-provider-ibm-cloud
  labels:
    app.kubernetes.io/instance: ibm-crossplane-provider-ibm-cloud
    app.kubernetes.io/managed-by: ibm-crossplane-provider-ibm-cloud
    app.kubernetes.io/name: ibm-crossplane-provider-ibm-cloud
rules:
  # for provider to manage crossplane resources
  - apiGroups:
      - cloudantv1.ibmcloud.crossplane.io
    resources:
      - cloudantdatabases
      # finalizers
      - cloudantdatabases/finalizers
      # status
      - cloudantdatabases/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - cos.ibmcloud.crossplane.io
    resources:
      - buckets
      - bucketconfigs
      # finalizers
      - buckets/finalizers
      - bucketconfigs/finalizers
      # status
      - buckets/status
      - bucketconfigs/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - eventstreamsadminv1.ibmcloud.crossplane.io
    resources:
      - topics
      # finalizers
      - topics/finalizers
      # status
      - topics/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - iamaccessgroupsv2.ibmcloud.crossplane.io
    resources:
      - accessgrouprules
      - accessgroups
      - groupmemberships
      # finalizers
      - accessgrouprules/finalizers
      - accessgroups/finalizers
      - groupmemberships/finalizers
      # status
      - accessgrouprules/status
      - accessgroups/status
      - groupmemberships/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - iampolicymanagementv1.ibmcloud.crossplane.io
    resources:
      - customroles
      - policies
      # finalizers
      - customroles/finalizers
      - policies/finalizers
      # status
      - customroles/status
      - policies/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ibmclouddatabasesv5.ibmcloud.crossplane.io
    resources:
      - autoscalinggroups
      - scalinggroups
      - whitelists
      # finalizers
      - autoscalinggroups/finalizers
      - scalinggroups/finalizers
      - whitelists/finalizers
      # status
      - autoscalinggroups/status
      - scalinggroups/status
      - whitelists/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - resourcecontrollerv2.ibmcloud.crossplane.io
    resources:
      - resourceinstances
      - resourcekeys
      # finalizers
      - resourceinstances/finalizers
      - resourcekeys/finalizers
      # status
      - resourceinstances/status
      - resourcekeys/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  # for provider to read configurations
  - apiGroups:
      - ibmcloud.crossplane.io
    resources:
      - providerconfigs
      - providerconfigusages
      # finalizers
      - providerconfigs/finalizers
      - providerconfigusages/finalizers
      # status
      - providerconfigs/status
      - providerconfigusages/status
    verbs:
      - create
      - get
      - list
      - patch
      - update
      - watch
