  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: clusterset-server
  rules:
    - apiGroups: [""]
      resources: ["configmaps", "namespaces", "events"]
      verbs: ["get", "list", "watch", "create", "update"]
    - apiGroups: ["rbac.authorization.k8s.io"]
      resources: ["clusterroles","clusterrolebindings"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["authorization.k8s.io"]
      resources: ["subjectaccessreviews"]
      verbs: ["get", "create"]
    - apiGroups: ["cluster.open-cluster-management.io"]
      resources: ["managedclusters","managedclustersets"]
      verbs: ["get", "list", "watch"]
  