apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: manager-role
rules:
##
## Base operator rules
##
# We need to get namespaces so the operator can read namespaces to ensure they exist
- apiGroups:
    - ""
  resources:
    - namespaces
  verbs:
    - get
# We need to manage Helm release secrets
- apiGroups:
    - ""
  resources:
    - secrets
  verbs:
    - "*"
# We need to create events on CRs about things happening during reconciliation
- apiGroups:
    - ""
  resources:
    - events
  verbs:
    - create
- apiGroups:
    - ""
  resources:
    - secrets
    - pods
    - pods/exec
    - pods/log
    - persistentVolumeClaim
    - persistentVolumes
    - services
    - serviceaccounts
    - configmaps
  verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
- apiGroups:
    - "admissionregistration.k8s.io"
  resources:
    - mutatingwebhookconfigurations
  verbs:
    - get
    - list
    - watch
    - delete
    - create
    - update
    - patch
- apiGroups:
    - authentication.k8s.io
  verbs:
    - get
    - list
    - watch
    - delete
    - create
    - update
    - patch
  resources:
    - tokenreviews
- apiGroups:
    - authorization.k8s.io
  verbs:
    - get
    - list
    - watch
    - delete
    - create
    - update
    - patch
  resources:
    - subjectaccessreviews
- apiGroups:
  - "rbac.authorization.k8s.io"
  resources:
    - clusterroles
    - clusterrolebindings
    - roles
    - rolebindings
  verbs:
    - get
    - list
    - watch
    - delete
    - create
    - update
    - patch
- apiGroups:
    - vault.sdbrett.com
  resources:
    - vaults
    - vaults/status
    - vaults/finalizers
  verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
- apiGroups:
    - "admissionregistration.k8s.io"
  resources:
    - "mutatingwebhookconfigurations"
  verbs:
    - "*"
- apiGroups:
    - ""
  resources:
    - "configmaps"
    - "serviceaccounts"
    - "services"
  verbs:
    - "*"
- apiGroups:
    - "apps"
  resources:
    - "deployments"
    - "statefulsets"
  verbs:
    - "*"
- apiGroups:
    - "networking.k8s.io"
  resources:
    - "networkpolicies"
  verbs:
    - get
    - list
    - watch
    - delete
    - create
    - update
    - patch
- apiGroups:
    - "route.openshift.io"
  resources:
    - "routes"
    - "routes/custom-host"
  verbs:
    - get
    - list
    - watch
    - delete
    - create
    - update
    - patch
# +kubebuilder:scaffold:rules
