# Copyright Contributors to the Open Cluster Management project

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: open-cluster-management:backplane:foundation
rules:
  - apiGroups: ["","events.k8s.io"]
    resources: ["configmaps", "namespaces", "events", "endpoints", "secrets"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "deletecollection", "patch"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles","clusterrolebindings"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "escalate", "bind"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["get", "create"]
  - apiGroups: ["certificates.k8s.io"]
    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
    verbs: ["get", "list", "watch", "create", "update"]
  - apiGroups: ["certificates.k8s.io"]
    resources: ["signers"]
    verbs: ["approve"]
  - apiGroups: ["apps.open-cluster-management.io"]
    resources: ["deployables", "deployables/status"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: ["cluster.open-cluster-management.io"]
    resources: ["managedclusters", "managedclustersets", "placementdecisions", "placementdecisions/status"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["cluster.open-cluster-management.io"]
    resources: ["managedclustersets/join"]
    verbs: ["create"]
  - apiGroups: [ "imageregistry.open-cluster-management.io" ]
    resources: [ "managedclusterimageregistries", "managedclusterimageregistries/status" ]
    verbs: [ "get", "list", "watch", "update" ]
  - apiGroups: [ "cluster.open-cluster-management.io" ]
    resources: [ "managedclusters/status"]
    verbs: ["patch", "update" ]
  - apiGroups: ["work.open-cluster-management.io"]
    resources: ["manifestworks"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["action.open-cluster-management.io"]
    resources: ["managedclusteractions", "managedclusteractions/status"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["internal.open-cluster-management.io"]
    resources: ["managedclusterinfos", "managedclusterinfos/status"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["view.open-cluster-management.io"]
    resources: ["managedclusterviews", "managedclusterviews/status"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: ["proxy.open-cluster-management.io"]
    resources: ["clusterstatuses/aggregator"]
    verbs: ["get", "create"]
  - apiGroups: ["hive.openshift.io"]
    resources: ["clusterdeployments", "clusterpools", "clusterclaims", "machinepools", "syncsets"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["hive.openshift.io"]
    resources: [ "syncsets"]
    verbs: ["create", "update", "delete"]
  - apiGroups: [ "hiveinternal.openshift.io" ]
    resources: [ "clustersyncs" ]
    verbs: [ "get", "list", "watch" ]
  - apiGroups: ["inventory.open-cluster-management.io"]
    resources: ["baremetalassets", "baremetalassets/status"]
    verbs: ["get", "list", "watch", "update", "delete"]
  - apiGroups: ["inventory.open-cluster-management.io"]
    resources: ["baremetalassets/finalizers"]
    verbs: ["update"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "create", "update"]
  - apiGroups: ["clusterview.open-cluster-management.io"]
    resources: ["managedclusters","managedclustersets"]
    verbs: ["list", "get", "watch"]
  - apiGroups: ["work.open-cluster-management.io"]
    resources: ["manifestworks"]
    verbs: ["create", "update", "get", "list", "watch", "delete", "deletecollection", "patch"]
  - apiGroups: ["addon.open-cluster-management.io"]
    resources: ["managedclusteraddons/finalizers"]
    verbs: ["update"]
  - apiGroups: ["addon.open-cluster-management.io"]
    resources: ["clustermanagementaddons/finalizers"]
    verbs: ["update"]
  - apiGroups: ["addon.open-cluster-management.io"]
    resources: ["clustermanagementaddons"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["addon.open-cluster-management.io"]
    resources: ["managedclusteraddons"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
  - apiGroups: ["addon.open-cluster-management.io"]
    resources: ["managedclusteraddons/status"]
    verbs: ["update", "patch"]
  - apiGroups: [ "metal3.io" ]
    resources: [ "baremetalhosts" ]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: [ "agent-install.openshift.io" ]
    resources: [ "agents", "infraenvs" ]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: [ "extensions.hive.openshift.io" ]
    resources: [ "agentclusterinstalls" ]
    verbs: ["get", "list", "watch", "update"]