apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: azure-defender-proxy-manager-role
  namespace: kube-system
  labels:
    app: azdproxy
    admission.azdproxy.sh/ignore: no-self-managing # This field assigned in order to verify that this resource won't be mutated by azdproxy
rules:
  # Cert-controller is using get,list and watch verbs on secrets
  - apiGroups: [ "" ]
    resources: [ "secrets" ]
    verbs: [ "list", "get", "watch" ]
  # Allow only to update azure-defender-cert secret - cert controller.
  - apiGroups: [ "" ]
    resources: [ "secrets" ]
    verbs: [ "list", "watch", "update", "get" ]
    resourceNames: [ "azure-defender-cert" ]
  # Cert-controller is using get,list and watch verbs on secrets
  - apiGroups: [ "admissionregistration.k8s.io" ]
    resources: [ "mutatingwebhookconfigurations" ]
    verbs: [ "get", "list", "watch" ]
  # Allow all verbs only on azure-defender-proxy-mutating-webhook-configuration MutatingWebhookConfiguration - cert controller.
  - apiGroups: [ "admissionregistration.k8s.io" ]
    resources: [ "mutatingwebhookconfigurations" ]
    verbs: [ "create","delete","get","list","patch","update","watch" ]
    resourceNames: [ "azure-defender-proxy-mutating-webhook-configuration" ]
