apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: rhoam-cs-sre-admin-project
rules:
 # CS SRE can run commands in pods
- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create
# CS SRE can delete jobs and builds
- apiGroups:
  - batch
  resources:
  - jobs
  - cronjobs
  verbs:
  - delete
  - deletecollection
- apiGroups:
  - build.openshift.io
  resources:
  - builds
  verbs:
  - delete
  - deletecollection
# CS SRE can use oc debug
- apiGroups:
  - ""
  resources:
  - pods
  - pods/attach
  verbs:
  - create
# CS SRE can get pod logs
- apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
# CS SRE can delete pods
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - delete
# CS SRE can interact with RHMI
- apiGroups:
  - integreatly.org
  resources:
  - '*'
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
# CS SRE can interact with secrets, configmaps and PVC's
- apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  - persistentvolumeclaims
  verbs:
  - "*"
# CS SRE can interact with installplans
- apiGroups:
  - "operators.coreos.com"
  resources:
  - installplans
  verbs:
  - "patch"
# CS SRE can list/get PDB
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - list
  - get
# CS SRE can list/get statefulsets
- apiGroups:
  - apps
  resources:
  - statefulsets
  verbs:
  - list
  - get
# CS SRE can list/get events
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - list
  - get
 # CS SRE can list/get endpoints
- apiGroups:
  - ""
  resources:
  - endpoints
  verbs:
  - list
  - get
