# project-admin has limited privileges under of
# project namespace used of RoleBinding.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: project-admin
  labels:
    kubecube.io/rbac: "true"
    kubecube.io/role: "project"
  annotations:
    kubecube.io/sync: "true"
#aggregationRule:
#  clusterRoleSelectors:
#    - matchLabels:
#        kubecube.io/aggregate-to-project-admin: "true"
rules:
  - apiGroups:
      - "*"
    resources:
      - pods
      - pods/attach
      - pods/status
      - pods/execescalate
      - pods/exec
      - pods/portforward
      - pods/proxy
      - pods/log
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - replicationcontrollers
      - replicationcontrollers/scale
      - replicationcontrollers/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - persistentvolumeclaims
      - persistentvolumeclaims/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - configmaps
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - services
      - services/proxy
      - services/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - serviceaccounts
    verbs:
      - impersonate
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - daemonsets
      - daemonsets/status
      - deployments
      - deployments/rollback
      - deployments/scale
      - deployments/status
      - statefulsets
      - statefulsets/scale
      - statefulsets/status
      - replicasets
      - replicasets/scale
      - replicasets/status
      - controllerrevisions
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - horizontalpodautoscalers
      - horizontalpodautoscalers/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - cronjobs
      - cronjobs/status
      - jobs
      - jobs/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - ingresses
      - ingresses/status
      - networkpolicies
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - poddisruptionbudgets
      - poddisruptionbudgets/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - bindings
      - events
      - limitranges
      - resourcequotas
      - resourcequotas/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - rolebindings
      - roles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - "*"
    resources:
      - cronjobs
      - cronjobs/status
      - jobs
      - jobs/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - bindings
      - events
      - limitranges
      - resourcequotas
      - resourcequotas/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"
    resources:
      - horizontalpodautoscalers
      - horizontalpodautoscalers/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*" #hnc.x-k8s.io
    resources:
      - hierarchyconfigurations
      - hncconfigurations
      - subnamespaceanchors
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*"  #monitoring.kubecube.io
    resources:
      - dashboards
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*" #netease.com
    resources:
      - nodelogconfigs
      - logconfigs
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
  - apiGroups:
      - "*" #monitoring.coreos.com
    resources:
      - alertmanagerconfigs
      - podmonitors
      - prometheusrules
      - servicemonitors
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update