apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: hazelcast-enterprise-operator
  labels:
    app.kubernetes.io/name: hazelcast-enterprise-operator
    app.kubernetes.io/instance: hazelcast-enterprise-operator
    app.kubernetes.io/managed-by: hazelcast-enterprise-operator

    # hazelcast and role labels for project-to-project communications via NetworkPolicy
    hazelcast: "true"
    role: hazelcast
rules:
  - apiGroups:
    - ""
    resources:
    - pods
    - services
    - endpoints
    - persistentvolumeclaims
    - events
    - configmaps
    - secrets
    verbs:
    - '*'
  - apiGroups:
    - ""
    - "extensions"
    resources:
    - ingresses
    verbs:
    - '*'
  - apiGroups:
    - ""
    resources:
    - namespaces
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    verbs:
    - get
    - create
    - list
    - update
    - delete
  - apiGroups:
    - rbac.authorization.k8s.io
    resources:
    - roles
    - rolebindings
    verbs:
    - get
    - create
    - list
    - update
    - delete
  - apiGroups:
    - apps
    resources:
    - deployments
    - daemonsets
    - replicasets
    - statefulsets
    verbs:
    - '*'
  - apiGroups:
    - monitoring.coreos.com
    resources:
    - servicemonitors
    verbs:
    - get
    - create
  - apiGroups:
    - apps
    resourceNames:
    - hazelcast-enterprise-operator
    resources:
    - deployments/finalizers
    verbs:
    - update
  - apiGroups:
    - hazelcast.com
    resources:
    - '*'
    verbs:
    - '*'
