---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-curator
rules:

# New Rules added to ClusterInstaller
# Leader Lock requires configmaps(create&get) and pods(get)
- apiGroups: ["tower.ansible.com","batch",""]
  resources: ["ansiblejobs","jobs","secrets","serviceaccounts"]
  verbs: ["create"]

- apiGroups: ["batch", "hive.openshift.io", "tower.ansible.com",""]
  resources: ["ansiblejobs","jobs","clusterdeployments","serviceaccounts"]
  verbs: ["get"]

- apiGroups: ["rbac.authorization.k8s.io",""]
  resources: ["roles","rolebindings"]
  verbs: ["create","get"]

- apiGroups: ["hive.openshift.io"]
  resources: ["clusterdeployments"]
  verbs: ["patch","delete"]

- apiGroups: ["internal.open-cluster-management.io",""]
  resources: ["managedclusterinfos","pods","secrets"]
  verbs: ["get"]

# Specific to the controller only
- apiGroups: ["cluster.open-cluster-management.io"] 
  resources: ["managedclusters"]
  verbs: ["list"]

- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["delete"]

- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]

# ClusterCurator apiGroup
- apiGroups:
  - cluster.open-cluster-management.io
  resources:
  - clustercurators
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - cluster.open-cluster-management.io
  resources:
  - clustercurators/status
  verbs:
  - get
  - patch
  - update

# Leader election
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - configmaps/status
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create