aggregationRule:
  clusterRoleSelectors:
  # aggregate all "project" scope rbac from SRE to dedicated-admins-project
  - matchExpressions:
    - key: managed.openshift.io/aggregate-to-dedicated-admins
      operator: In
      values:
        - "project"
  # aggregate all "admin" scope rbac from OCP to dedicated-admins-project (webhooks deny management of specific SRE apiGroups)
  - matchExpressions:
    - key: rbac.authorization.k8s.io/aggregate-to-admin
      operator: In
      values:
        - "true"
  # aggregate all customer installed operator rbac from OLM to dedicated-admins-cluster (4.3.12+)
  - matchExpressions:
    - key: olm.owner.kind
      operator: In
      values:
      - OperatorGroup
    - key: olm.owner.namespace
      operator: NotIn
      values:
      - openshift-cloud-ingress-operator
      - openshift-monitoring
      - openshift-operator-lifecycle-manager
      - openshift-rbac-permissions
      - openshift-splunk-forwarder-operator
      - openshift-velero
      - openshift-managed-upgrade-operator
      - openshift-ocm-agent-operator
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dedicated-admins-project
rules: []
