---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: role-read
  namespace: default    # This is mandatory, if omitted then 'default' is used
rules:
  - apiGroups: [""]      # find this by running the 'kubectl api-resources' command
    resources: ["pods"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]             # find this by running the 'kubectl api-resources' command
    resources: ["services"]
    verbs: ["get", "watch", "list"]
