apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: backplane-rhmi-cssre-admins-cluster-aggregate
  labels:
    managed.openshift.io/aggregate-to-cssre-admins: "cluster"
rules:
# CS SRE can manage projects
- apiGroups:
  - config.openshift.io
  resources:
  - projects
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
# CS SRE can get infrastructure details (cluster)
- apiGroups:
  - config.openshift.io
  resources:
  - infrastructures
  - oauths
  verbs:
  - 'get'
- apiGroups:
  - project.openshift.io
  resources:
  - projects
  verbs:
  - '*'
# CS SRE can manage namespaces
- apiGroups:
  - ""
  resources:
  - namespaces
  - namespaces/finalize
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
# CS SRE can update existing groups (enables break glass)
- apiGroups:
  - user.openshift.io
  resources:
  - groups
  verbs:
  - patch
  - update
  - get
# CS SRE can interact with RHMI ClusterResourceQuotas (Only for LA)
- apiGroups:
  - quota.openshift.io
  resources:
  - clusterresourcequotas/status
  - clusterresourcequotas
  verbs:
  - '*'
# CS SRE manage the following list of apigroups
- apiGroups:
  - "apiextensions.k8s.io"
  - "admin-enmasse.io"
  - "apicur.io"
  - "applicationmonitoring.integreatly.org"
  - "apps.3scale.net"
  - "capabilities.3scale.net"
  - "enmasse.io"
  - "iot.enmasse.io"
  - "keycloak.org"
  - "monitoring.coreos.com"
  - "push.aerogear.org"
  - "org.eclipse.che"
  - "syndesis.io"
  resources:
  - '*'
  verbs:
  - create
  - get
  - list 
  - patch 
  - update 
  - watch
