---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: submariner-diagnose
rules:
  # submariner-diagnose runs subctl diagnose to troubleshoot submariner
  # dpeloyment
  - apiGroups:  # nodes are looked up to figure out network settings
      - ""
    resources:
      - configmaps
      - nodes
    verbs:
      - get
      - list
  - apiGroups:  # pods are created to run firewall diagnostics
      - ""
    resources:
      - pods
    verbs:
      - create
      - get
      - list
