apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
- apiGroups:
    - networking.k8s.io
  resources:
    - networkpolicies
  verbs:
    - get
    - list
    - watch
- apiGroups:
    - discovery.k8s.io
  resources:
    - endpointslices
  verbs:
    - get
    - list
    - watch
- apiGroups:
    - ""
  resources:
    - namespaces
    - services
    - nodes
    - endpoints
  verbs:
    - get
    - list
    - watch
- apiGroups:
    - ""
  resources:
    - pods
    - pods/finalizers
  verbs:
    - get
    - list
    - watch
    - update
    - delete
- apiGroups:
    - ""
  resources:
    - nodes
  verbs:
    - get
    - list
    - watch
    - update
- apiGroups:
    - ""
  resources:
    - nodes
    - nodes/status
  verbs:
    - patch
- apiGroups:
    - apiextensions.k8s.io
  resources:
    - customresourcedefinitions
  verbs:
    # Deprecated for removal in v1.10
    - create
    - list
    - watch
    - update
    # This is used when validating policies in preflight. This will need to stay
    # until we figure out how to avoid "get" inside the preflight, and then
    # should be removed ideally.
    - get
- apiGroups:
    - cilium.io
  resources:
    - ciliumnetworkpolicies
    - ciliumnetworkpolicies/status
    - ciliumnetworkpolicies/finalizers
    - ciliumclusterwidenetworkpolicies
    - ciliumclusterwidenetworkpolicies/status
    - ciliumclusterwidenetworkpolicies/finalizers
    - ciliumendpoints
    - ciliumendpoints/status
    - ciliumendpoints/finalizers
    - ciliumnodes
    - ciliumnodes/status
    - ciliumnodes/finalizers
    - ciliumidentities
    - ciliumidentities/finalizers
    - ciliumlocalredirectpolicies
    - ciliumlocalredirectpolicies/status
    - ciliumlocalredirectpolicies/finalizers
  verbs:
    - '*'
