kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
rules:
  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
  - apiGroups: ['']
    resources: ['secrets']
    verbs: ['create']
    # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
  - apiGroups: ['']
    resources: ['configmaps']
    verbs: ['create']
    # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  - apiGroups: ['']
    resources: ['secrets']
    resourceNames: ['kubernetes-dashboard-key-holder', 'kubernetes-dashboard-certs']
    verbs: ['get', 'update', 'delete']
    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
  - apiGroups: ['']
    resources: ['configmaps']
    resourceNames: ['kubernetes-dashboard-settings']
    verbs: ['get', 'update']
    # Allow Dashboard to get metrics from heapster.
  - apiGroups: ['']
    resources: ['services']
    resourceNames: ['heapster']
    verbs: ['proxy']
  - apiGroups: ['']
    resources: ['services/proxy']
    resourceNames: ['heapster', 'http:heapster:', 'https:heapster:']
    verbs: ['get']
