# Copyright Contributors to the Open Cluster Management project
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: governance-policy-propagator
rules:
- apiGroups:
  - apps.open-cluster-management.io
  resources:
  - placementrules
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cluster.open-cluster-management.io
  resources:
  - managedclusters
  - placementdecisions
  - placements
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resourceNames:
  - policy-encryption-key
  resources:
  - secrets
  verbs:
  - get
  - update
  - watch
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - placementbindings
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policies
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policies/finalizers
  verbs:
  - update
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policies/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policyautomations
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policyautomations/finalizers
  verbs:
  - update
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policyautomations/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policysets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policysets/finalizers
  verbs:
  - update
- apiGroups:
  - policy.open-cluster-management.io
  resources:
  - policysets/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - tower.ansible.com
  resources:
  - ansiblejobs
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
