apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: open-cluster-management:hub-of-hubs-addon-controller
rules:
# Allow hub to manage managedclusters
- apiGroups: ["cluster.open-cluster-management.io"]
  resources: ["managedclusters"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["cluster.open-cluster-management.io"]
  resources: ["managedclusters/status"]
  verbs: ["update", "patch"]
- apiGroups: ["work.open-cluster-management.io"]
  resources: ["manifestworks"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
# Allow hub to get/list/watch/create/delete configmap, namespace and service account
- apiGroups: [""]
  resources: ["namespaces", "serviceaccounts", "configmaps", "events"]
  verbs: ["get", "list", "watch", "create", "delete", "update"]
# Allow to get Kafka
- apiGroups: ["kafka.strimzi.io"]
  resources: ["kafkas"]
  verbs: ["get"]
- apiGroups: ["route.openshift.io"]
  resources: ["routes"]
  verbs: ["get"]
