apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: layered-cs-sre-admin-cluster
rules:
# CS SRE can manage projects
- apiGroups:
  - config.openshift.io
  resources:
  - projects
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
# CS SRE can get infrastructure details (cluster)
- apiGroups:
  - config.openshift.io
  resources:
  - infrastructures
  - oauths
  verbs:
  - 'get'
- apiGroups:
  - project.openshift.io
  resources:
  - projects
  verbs:
  - '*'
# CS SRE can manage namespaces
- apiGroups:
  - ""
  resources:
  - namespaces
  - namespaces/finalize
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
# CS SRE can update existing groups (enables break glass)
- apiGroups:
  - user.openshift.io
  resources:
  - groups
  verbs:
  - patch
  - update
  - get
# CS SRE can interact with RHMI ClusterResourceQuotas (Only for LA)
- apiGroups:
  - quota.openshift.io
  resources:
  - clusterresourcequotas/status
  - clusterresourcequotas
  verbs:
  - '*'
