apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: open-cluster-management:managedcluster:registration
rules:
# Allow spoke registration agent to get/update coordination.k8s.io/lease
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  #TODO: for backward compatible, we do not limit the resource name in release 2.3.
  #After release 2.3, we will limit the resource name.
  #resourceNames: ["managed-cluster-lease"]
  verbs: ["get", "update"]
