# ordinary only has read authority under of
# bottom layer namespace used of RoleBinding.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: reviewer-cluster
  annotations:
    kubecube.io/sync: "true"
#aggregationRule:
#  clusterRoleSelectors:
#    - matchLabels:
#        kubecube.io/aggregate-to-reviewer-cluster: "true"
rules:
  - apiGroups:
      - ""
    resources:
      - namespaces
      - namespaces/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - metrics.k8s.io
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
  # reviewer has read authority of user
  - apiGroups:
      - user.kubecube.io
    resources:
      - users
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - user.kubecube.io
    resources:
      - users/status
    verbs:
      - get
  - apiGroups:
      - storage.k8s.io
    resources:
      - storageclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - persistentvolumes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "*" #apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "*" #storage.kubecube.io
    resources:
      - cephs
    verbs:
      - get
      - list