---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ibm-crossplane
  labels:
    app.kubernetes.io/instance: ibm-crossplane-operator
    app.kubernetes.io/managed-by: ibm-crossplane-operator
    app.kubernetes.io/name: ibm-crossplane
rules:
# for crossplane to list and watch CRDs
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
# for crossplane to register crossplane events
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - update
  - patch
  - delete
# for crossplane to manage crossplane resources
- apiGroups:
  - apiextensions.ibm.crossplane.io
  - pkg.ibm.crossplane.io
  - kubernetes.crossplane.io
  resources:
  - locks
  - compositeresourcedefinitions
  - compositions
  - providers
  - providerrevisions
  - configurations
  - configurationrevisions
  - controllerconfigs
  - objects
  # finalizers
  - locks/finalizers
  - compositeresourcedefinitions/finalizers
  - compositions/finalizers
  - providers/finalizers
  - providerrevisions/finalizers
  - configurations/finalizers
  - configurationrevisions/finalizers
  - controllerconfigs/finalizers
  - objects/finalizers
  # status
  - locks/status
  - compositeresourcedefinitions/status
  - compositions/status
  - providers/status
  - providerrevisions/status
  - configurations/status
  - configurationrevisions/status
  - controllerconfigs/status
  - objects/status
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
