apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: palantir-operator-clusterrole
  labels:
    app.kubernetes.io/name: "palantir-operator"
    app.kubernetes.io/managed-by: "palantir.com"
    app.kubernetes.io/instance: "palantir-operator"
rules:
- apiGroups: [""]
  resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "events", "configmaps", "secrets", "serviceaccounts"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "create", "update"]
- apiGroups: ["apps", "extensions"]
  resources: ["deployments", "statefulsets", "ingresses"]
  verbs: ["*"]
- apiGroups: ["networking.k8s.io"]
  resources: ["networkpolicies"]
  verbs: ["list", "update", "get", "watch", "patch", "create", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings", "clusterrolebindings"]
  verbs: ["list", "update", "get", "watch", "patch", "create", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "clusterroles"]
  verbs: ["list", "update", "get", "watch", "patch", "create", "delete", "escalate", "bind"]
- apiGroups: ["batch", "extensions"]
  resources: ["jobs"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["list", "get"]
- apiGroups: ["route.openshift.io"]
  resources: ["routes"]
  verbs: ["get", "create", "update"]
- apiGroups: ["route.openshift.io"]
  resources: ["routes/custom-host"]
  verbs: ["create"]
- apiGroups: ["policy"]
  resources: ["poddisruptionbudgets"]
  verbs: ['*']
- apiGroups: ["deploy.palantir.com"]
  resources: ["crossnamespacediscoverytargets"]
  verbs: ["get", "create", "update"]  
