aggregationRule:
  clusterRoleSelectors:
    # aggregate all "view" scope rbac
    - matchExpressions:
        - key: rbac.authorization.k8s.io/aggregate-to-view
          operator: In
          values:
            - "true"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: osd-devaccess
rules:
  # devaccess can get and list nodes
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
  # devaccess can run commands in pods
  - apiGroups:
      - ""
    resources:
      - pods/exec
    verbs:
      - create
  # devaccess can get and list projects
  - apiGroups:
      - config.openshift.io
    resources:
      - projects
    verbs:
      - get
      - list
  - apiGroups:
      - project.openshift.io
    resources:
      - projects
    verbs:
      - get
      - list
  # devaccess can get and list existing groups
  - apiGroups:
      - user.openshift.io
    resources:
      - groups
    verbs:
      - get
      - list
  # devaccess can get and list namespaces
  - apiGroups:
      - ""
    resources:
      - namespaces
      - namespaces/finalize
    verbs:
      - get
      - list
  # devaccess can get and list pods
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
  # devaccess can review pod security policies
  - apiGroups:
      - security.openshift.io
    resources:
      - podsecuritypolicyreviews
      - podsecuritypolicyselfsubjectreviews
      - podsecuritypolicysubjectreviews
    verbs:
      - create
  # devaccess can review RBAC policies (i.e. oc adm policy who-can ...)
  - apiGroups:
      - authorization.openshift.io
    resources:
      - localresourceaccessreviews
    verbs:
      - create
  # devaccess can get and post to all endpoints
  - nonResourceURLs:
      - "*"
    verbs:
      - "*"
