apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: "clusterapi:controller-manager"
rules:
# configmaps for leader election
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create"]
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["cluster-operator-controller-manager"]
  verbs: ["get", "update"]
# events for recording events
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "patch", "update"]
# allow all operations on all resources in our API group
- apiGroups: ["cluster.k8s.io"]
  resources: ["*"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
# allow operations on required resources in any namespace a cluster is created
- apiGroups: [""]
  resources: ["configmaps", "pods", "secrets", "nodes"]
  verbs: ["*"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["*"]
