kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: multicluster-mesh-addon
rules:
- apiGroups: [""]
  resources: ["configmaps", "events", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "delete", "deletecollection", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: ["authorization.k8s.io"]
  resources: ["subjectaccessreviews"]
  verbs: ["get", "create"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
  verbs: ["get", "list", "watch", "create", "update"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["signers"]
  verbs: ["approve"]
- apiGroups: ["cluster.open-cluster-management.io"]
  resources: ["managedclusters"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["work.open-cluster-management.io"]
  resources: ["manifestworks"]
  verbs: ["create", "update", "get", "list", "watch", "delete", "deletecollection", "patch"]
- apiGroups: ["addon.open-cluster-management.io"]
  resources: ["managedclusteraddons/finalizers"]
  verbs: ["update"]
- apiGroups: ["addon.open-cluster-management.io"]
  resources: ["clustermanagementaddons"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["addon.open-cluster-management.io"]
  resources: ["managedclusteraddons"]
  verbs: ["get", "list", "watch", "create", "update"]
- apiGroups: ["addon.open-cluster-management.io"]
  resources: ["managedclusteraddons/status"]
  verbs: ["update", "patch"]
- apiGroups: ["mesh.open-cluster-management.io"]
  resources: ["meshes", "meshdeployments", "meshfederations"]
  verbs: ["*"]
