---
# Source: consul/templates/connect-inject-clusterrole.yaml
# The ClusterRole to enable the Connect injector to get, list, watch and patch MutatingWebhookConfiguration.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: consul-oc-consul-connect-injector-webhook
  labels:
    app: consul
    chart: consul-helm
    heritage: Tiller
    release: consul-oc
rules:
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  verbs: 
    - "get"
    - "list"
    - "watch"
    - "patch"
- apiGroups: ["policy"]
  resources: ["podsecuritypolicies"]
  resourceNames:
  - consul-oc-consul-connect-injector-webhook
  verbs:
  - use
