apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: unip-controller-cluster-role
rules:
  # Framework: knowing which other operators are running (i.e. peering).
  - apiGroups: ["kopf.dev"]
    resources: ["clusterkopfpeerings", "kopfpeerings"]
    verbs: ["list", "watch", "patch", "get"]
  # Framework: runtime observation of namespaces & CRDs (addition/deletion).
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["list", "watch"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["rolebindings", "roles", "clusterroles", "clusterrolebindings"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["pods", "endpointslices", "services", "replicationcontrollers", "secrets", "configmaps", "endpoints",
                "nodes", "namespaces", "events", "persistentvolumeclaims", "persistentvolumes",  "serviceaccounts",
                "pods/log", "pods/exec", "serviceaccounts/token"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Framework: admission webhook configuration management.
  - apiGroups: ["admissionregistration.k8s.io/v1", "admissionregistration.k8s.io/v1beta1"]
    resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
    verbs: ["create", "patch"]
  # Application: read-only access for watching cluster-wide.
  - apiGroups: ["unified-platform.cs.hse.ru"]
    resources: ["mlcomponents", "platformusers", "platformapps", "databoxes", "repositories",
                "experimentpipelines",
                "mlcomponents/status", "platformusers/status", "platformapps/status",
                "databoxes/status", "repositories/status",
                "experimentpipelines/status",
                "apicomponents", "apicomponents/status",
                "componentlinks", "componentlinks/status",
                "datasetcomponents", "datasetcomponents/status"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets", "daemonsets", "statefulsets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["networking.k8s.io", "networking", "extensions"]
    resources: ["ingresses", "ingressclasses", "networkpolicies"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]