apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-sync-controller
rules:
# Framework: knowing which other operators are running (i.e. peering).
- apiGroups: [zalando.org]
  resources: [clusterkopfpeerings]
  verbs: [list, watch, patch, get]
- apiGroups: [apiextensions.k8s.io]
  resources: [customresourcedefinitions]
  verbs: [list, get]
# Framework: posting the events about the handlers progress/errors.
- apiGroups: [events.k8s.io]
  resources: [events]
  verbs: [create]
- apiGroups: [""]
  resources: [events]
  verbs: [create]
# Application: watch and manipulate secrets.
- apiGroups: [""]
  resources: [secrets]
  verbs: [get, update, list, patch, watch]
