apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-reader-istio-system
rules:
  - resources: ["*"]
    apiGroups:
      - "config.istio.io"
      - "security.istio.io"
      - "networking.istio.io"
      - "authentication.istio.io"
      - "rbac.istio.io"
    verbs: ["get", "list", "watch"]
  - resources:
      [
        "endpoints",
        "pods",
        "services",
        "nodes",
        "replicationcontrollers",
        "namespaces",
        "secrets",
      ]
    apiGroups: [""]
    verbs: ["get", "list", "watch"]
  - resources: ["workloadentries"]
    apiGroups: ["networking.istio.io"]
    verbs: ["get", "watch", "list"]
  - resources: ["customresourcedefinitions"]
    apiGroups: ["apiextensions.k8s.io"]
    verbs: ["get", "list", "watch"]
  - resources: ["endpointslices"]
    apiGroups: ["discovery.k8s.io"]
    verbs: ["get", "list", "watch"]
  - resources: ["replicasets"]
    apiGroups: ["apps"]
    verbs: ["get", "list", "watch"]
  - resources: ["tokenreviews"]
    apiGroups: ["authentication.k8s.io"]
    verbs: ["create"]
  - resources: ["subjectaccessreviews"]
    apiGroups: ["authorization.k8s.io"]
    verbs: ["create"]
  - resources: ["serviceexports"]
    apiGroups: ["multicluster.x-k8s.io"]
    verbs: ["get", "watch", "list"]
  - resources: ["serviceimports"]
    apiGroups: ["multicluster.x-k8s.io"]
    verbs: ["get", "watch", "list"]
