## this is a set of basic permissions the Jaeger Operator needs when restricted to work in specific namespaces
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: jaeger-operator
rules:

  ## our own custom resources
  - apiGroups:
      - jaegertracing.io
    resources:
      - '*'
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch

  ## for the operator's own deployment
  - apiGroups:
      - apps
    resourceNames:
      - jaeger-operator
    resources:
      - deployments/finalizers
    verbs:
      - update

  ## regular things the operator manages for an instance, as the result of processing CRs
  - apiGroups:
      - ""
    resources:
      - configmaps
      - persistentvolumeclaims
      - pods
      - secrets
      - serviceaccounts
      - services
      - services/finalizers
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  # Ingress for kubernetes 1.14 or higher
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - batch
    resources:
      - jobs
      - cronjobs
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - route.openshift.io
    resources:
      - routes
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - image.openshift.io
    resources:
      - imagestreams
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - autoscaling
    resources:
      - horizontalpodautoscalers
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch

  ## needed if you want the operator to create service monitors for the Jaeger instances
  - apiGroups:
      - monitoring.coreos.com
    resources:
      - servicemonitors
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch

  ## for the Elasticsearch auto-provisioning
  - apiGroups:
      - logging.openshift.io
    resources:
      - elasticsearches
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch

  ## for the Kafka auto-provisioning
  - apiGroups:
      - kafka.strimzi.io
    resources:
      - kafkas
      - kafkausers
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch

