kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: certificate-generator
rules:
  - apiGroups:
      - certificates.k8s.io
    resources:
      - certificatesigningrequests
      # Uncomment for auto approval of CSRs
      # - certificatesigningrequests/approval
    # Restrict access to just the CSRs the certificate generator creates
    #resourceNames:
    #  - ${service-name}.${service-namespace}
    verbs:
      - create
      - update
      - get

  # If you want to allow the service account to work across multiple namespaces,
  # Uncomment the following or create the role and rolebindg across each namespace
  #- apiGroups:
  #    - ""
  #  resources:
  #    - secrets
  #  verbs:
  #    - create
  #    - update
  #    - get


  # Delete everything below this line if you aren't auto patching webhook configurations

  # -------------------
  # Auto Patching rules
  # -------------------

  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    # Restrict access to just the webhook configurations named
    #resourceNames:
    #  - ${mutatingwebhookconfiguration-name}
    #  - ${validatingwebhookconfiguration-name}
    verbs:
      - update
      - get

  # This configmap is autogenerated by Kubernetes and only exists in the
  # kube-system namespace, saves creating another role and rolebinding
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - extension-apiserver-authentication
    verbs:
      - get
