
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: operator-role
rules:

# The Mesh CRD. Acquired to assign as the resource owner when creating cluster-scoped resources.
# When the CRD is deleted from the cluster, this ensures all cluster-scoped resources are also cleaned up.
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  resourceNames: ["meshes.greymatter.io"]
  verbs: ["get"]

# All Mesh ops.
- apiGroups: ["greymatter.io"]
  resources: ["meshes"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["greymatter.io"]
  resources: ["meshes/status"]
  verbs: ["get", "patch", "update"]

# Patch webhook configurations which exist at runtime.
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
  resourceNames: ["gm-mutate-config", "gm-validate-config"]
  verbs: ["get", "patch"]

# Apply mesh core services and label/annotate for fabric configuration.
- apiGroups: ["apps"]
  resources: ["deployments", "statefulsets"]
  verbs: ["get", "list", "create", "update"]

# Apply mesh core service configurations.
# Note: patch is needed for the webhook cert secret.
- apiGroups: [""]
  resources: ["configmaps", "secrets", "serviceaccounts", "services"]
  verbs: ["get", "create", "update", "patch"]

# Apply a clusterrole and clusterrolebinding
# which allows each mesh control plane to discover pods.
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings", "clusterroles"]
  verbs: ["get", "create", "update"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]

# Apply mesh ingresses.
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "create", "update"]

# Identify OpenShift cluster-wide ingress information if configured.
- apiGroups: ["config.openshift.io"]
  resources: ["ingresses"]
  verbs: ["list"]

# The remainder of permissions are SPIRE-specific.

# Create the spire namesapce.
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "create"]
# Create the SPIRE agent daemonset.
- apiGroups: ["apps"]
  resources: ["daemonsets"]
  verbs: ["get", "create"]
# Create the SPIRE server's role and rolebinding.
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings"]
  verbs: ["get", "create"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["list"]
# These are granted to the clusterrole used by the SPIRE server.
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["get", "create"]
# These are granted to clusterroles used by the SPIRE server and agent.
- apiGroups: [""]
  resources: ["nodes", "nodes/proxy", "pods"]
  verbs: ["get", "list", "watch"]
