apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: manager-role
rules:
##
## Base operator rules
##
# We need to get namespaces so the operator can read namespaces to ensure they exist
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
# We need to manage Helm release secrets
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - "*"
# We need to create events on CRs about things happening during reconciliation
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create

# We need to allow managing Build, ImageStream and BuildConfig resources
- apiGroups:
  - image.openshift.io
  resources:
  - imagestreams
  verbs:
  - '*'
- apiGroups:
  - build.openshift.io
  resources:
  - buildconfigs
  verbs:
  - '*'

##
## Rules for intel.com/v1alpha1 Kind: ModelServer, Notebook
##
- apiGroups:
  - intel.com
  resources:
  - modelservers
  - modelservers/status
  - modelservers/finalizers
  - notebooks
  - notebooks/status
  - notebooks/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create

# +kubebuilder:scaffold:rules
