kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nsx-ncp-operator
rules:
- apiGroups: ['']
  resources: [pods, configmaps, namespaces, serviceaccounts, secrets, nodes/status]
  verbs: [create, get, list, patch, delete, update, watch, deletecollection]
- apiGroups: ['']
  resources: [nodes]
  verbs: [get, list, watch]
- apiGroups: [config.openshift.io]
  resources: [networks, networks/finalizers]
  verbs: [get, list, watch, patch, update]
- apiGroups: [apps]
  resources: [deployments, daemonsets]
  verbs: [create, get, list, patch, delete, update, watch]
- apiGroups: [config.openshift.io, apiextensions.k8s.io]
  resources: [clusteroperators, clusteroperators/status, customresourcedefinitions]
  verbs: [create, get, list, patch, update, watch, delete]
- apiGroups: [rbac.authorization.k8s.io]
  resources: [clusterroles, clusterrolebindings, roles, rolebindings]
  verbs: [create, get, list, patch, update, watch, delete]
- apiGroups: [operator.nsx.vmware.com]
  resources: [ncpinstalls, ncpinstalls/status]
  verbs: [get, list, watch, patch, update]
# Required by nsx-node-agent
- apiGroups: ['']
  resources: [endpoints, services]
  verbs: [get, list, watch]
# Required by nsx-ncp
- apiGroups: ['', extensions, networking.k8s.io, config.openshift.io, apps]
  resources: [deployments, endpoints, pods/log, nodes, replicationcontrollers, secrets,
    ingressclasses, routes, network, networks, statefulsets]
  verbs: [get, watch, list]
- apiGroups: [route.openshift.io]
  resources: [routes]
  verbs: [get, watch, list]
- apiGroups: ['', extensions, networking.k8s.io, apps]
  resources: [namespaces, ingresses, services, pods, networkpolicies, routes, statefulsets]
  verbs: [get, watch, list, update, patch]
- apiGroups: [nsx.vmware.com]
  resources: [nsxerrors, nsxlocks, ncpconfigs]
  verbs: [create, get, list, patch, delete, update]
- apiGroups: ['', extensions, networking.k8s.io]
  resources: [ingresses/status, services/status, routes/status]
  verbs: [replace, update, patch]
- apiGroups: [config.openshift.io]
  resources: [networks]
  verbs: [patch]
- apiGroups: [route.openshift.io]
  resources: [routes, routes/status]
  verbs: [patch, update]
- apiGroups: [k8s.cni.cncf.io]
  resources: [network-attachment-definitions]
  verbs: [get, list, watch]
- apiGroups: [vmware.com]
  resources: [loadbalancers, loadbalancers/status, nsxlbmonitors, nsxlbmonitors/status, virtualnetworkinterfaces, virtualnetworkinterfaces/status, virtualnetworks, virtualnetworks/status]
  verbs: [create, get, list, patch, update, watch, delete]
- apiGroups: ['']
  resources: [pods/exec]
  verbs: [get, create]
- apiGroups: ['']
  resources: [events]
  verbs: [create, get, list, patch, update, delete]
