apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubernetes-external-secrets
  labels:
    app.kubernetes.io/name: kubernetes-external-secrets
    app.kubernetes.io/instance: kubernetes-external-secrets
rules:
  - apiGroups: 
      - ""
    resources: 
        - secrets
    verbs: 
        - create
        - update
  - apiGroups: 
      - ""
    resources: 
        - namespaces
    verbs: 
        - get
        - watch
        - list
  - apiGroups: 
      - apiextensions.k8s.io
    resources: 
        - customresourcedefinitions
    resourceNames: 
        - externalsecrets.kubernetes-client.io
    verbs: 
        - get
        - update
  - apiGroups: 
      - kubernetes-client.io
    resources: 
        - externalsecrets
    verbs: 
        - get
        - watch
        - list
  - apiGroups: 
      - kubernetes-client.io
    resources: 
        - externalsecrets/status
    verbs: 
        - get
        - update
