apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: ops-user-cluster-role
rules:
- apiGroups: ["", "autoscaling","batch","cloud.google.com","authentication.k8s.io","authorization.k8s.io","admissionregistration.k8s.io","apiregistration.k8s.io","extensions","apiextensions.k8s.io","apps","rbac.authorization.k8s.io","policy","storage.k8s.io","scheduling.k8s.io","scalingpolicy.kope.io,","networking.k8s.io","networking.gke.io","metrics.k8s.io","certificates.k8s.io","coordination.k8s.io","node.k8s.io"]
  resources: ["bindings","componentstatuses","configmaps","endpoints","events","limitranges","namespaces","nodes","persistentvolumeclaims","persistentvolumes","pods","podtemplates","replicationcontrollers","resourcequotas","serviceaccounts","services","mutatingwebhookconfigurations","validatingwebhookconfigurations","customresourcedefinitions","apiservices","controllerrevisions","daemonsets","deployments","replicasets","statefulsets","meshpolicies","policies","tokenreviews","localsubjectaccessreviews","selfsubjectaccessreviews","selfsubjectrulesreviews","subjectaccessreviews","horizontalpodautoscalers","cronjobs","jobs","certificatesigningrequests","backendconfigs","adapters","attributemanifests","handlers","httpapispecbindings","httpapispecs","instances","quotaspecbindings","quotaspecs","rules","templates","leases","daemonsets","deployments","ingresses","networkpolicies","podsecuritypolicies","replicasets","nodes","pods","managedcertificates","destinationrules","envoyfilters","gateways","serviceentries","sidecars","virtualservices","ingresses","networkpolicies","runtimeclasses","updateinfos","poddisruptionbudgets","podsecuritypolicies","clusterroles",roles","clusterrbacconfigs","rbacconfigs",serviceroles","scalingpolicies","priorityclasses","authorizationpolicies","peerauthentications","requestauthentications","csidrivers","csinodes","storageclasses","volumeattachments"]
  verbs: ["*"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings","rolebindings"]
  verbs: ["get", "watch", "list"]
