apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
- apiGroups:
    - ""
  resources:
    # to automatically delete [core|kube]dns pods so that are starting to being
    # managed by Cilium
    - pods
  verbs:
    - get
    - list
    - watch
    - delete
- apiGroups:
    - discovery.k8s.io
  resources:
    - endpointslices
  verbs:
    - get
    - list
    - watch
- apiGroups:
    - ""
  resources:
    # to perform the translation of a CNP that contains `ToGroup` to its endpoints
    - services
    - endpoints
    # to check apiserver connectivity
    - namespaces
  verbs:
    - get
    - list
    - watch
- apiGroups:
    - cilium.io
  resources:
    - ciliumnetworkpolicies
    - ciliumnetworkpolicies/status
    - ciliumnetworkpolicies/finalizers
    - ciliumclusterwidenetworkpolicies
    - ciliumclusterwidenetworkpolicies/status
    - ciliumclusterwidenetworkpolicies/finalizers
    - ciliumendpoints
    - ciliumendpoints/status
    - ciliumendpoints/finalizers
    - ciliumnodes
    - ciliumnodes/status
    - ciliumnodes/finalizers
    - ciliumidentities
    - ciliumidentities/status
    - ciliumidentities/finalizers
    - ciliumlocalredirectpolicies
    - ciliumlocalredirectpolicies/status
    - ciliumlocalredirectpolicies/finalizers
  verbs:
    - '*'
- apiGroups:
    - apiextensions.k8s.io
  resources:
    - customresourcedefinitions
  verbs:
    - create
    - get
    - list
    - update
    - watch
# For cilium-operator running in HA mode.
#
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
# between mulitple running instances.
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
# common and fewer objects in the cluster watch "all Leases".
# The support for leases was introduced in coordination.k8s.io/v1 during Kubernetes 1.14 release.
# In Cilium we currently don't support HA mode for K8s version < 1.14. This condition make sure
# that we only authorize access to leases resources in supported K8s versions.
- apiGroups:
    - coordination.k8s.io
  resources:
    - leases
  verbs:
    - create
    - get
    - update