aggregationRule:
  clusterRoleSelectors:
  # aggregate all "project" scope rbac from SRE to dedicated-admins-project
  - matchExpressions:
    - key: managed.openshift.io/aggregate-to-dedicated-admins
      operator: In
      values:
        - "project"
  # aggregate all "admin" scope rbac from OCP to dedicated-admins-project
  - matchExpressions:
    - key: rbac.authorization.k8s.io/aggregate-to-admin
      operator: In
      values:
        - "true"
  # aggregate all customer installed operator rbac from OLM to dedicated-admins-project
  - matchExpressions:
    - key: olm.opgroup.permissions/aggregate-to-admin
      operator: In
      values:
        - openshift-logging
        - openshift-operators
        - openshift-operators-redhat
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dedicated-admins-project
rules: []