---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kotsadm-cluster-role-binding
subjects:
  - kind: ServiceAccount
    name: kotsadm
    namespace: itrs
roleRef:
  kind: ClusterRole
  name: kotsadm-cluster-role
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kotsadm-cluster-role
rules:
#Required rules for cert-manager
- apiGroups: ["cert-manager.io"]
  resources: ["*"]
  verbs: ["approve", "create", "delete", "deletecollection", "get", "list", "update", "patch", "watch"]
- apiGroups: ["acme.cert-manager.io"]
  resources: ["*"]
  verbs: ["create", "delete", "get", "list", "watch", "update", "patch", "deletecollection"]
- apiGroups: [""]
  resources: ["events", "secrets", "pods", "services", "namespaces"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: ["apiregistration.k8s.io"]
  resources: ["apiservices"]
  verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: ["route.openshift.io"]
  resources: ["routes/custom-host"]
  verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
  resources: ["subjectaccessreviews"]
  verbs: ["create"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles", "clusterrolebindings", "roles", "rolebindings"]
  verbs: ["create", "get", "list", "watch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings"]
  verbs: ["delete", "patch"]
- apiGroups: ["gateway.networking.k8s.io"]
  resources: ["gateways", "httproutes", "httproutes/finalizers", "gateways/finalizers"]
  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses", "ingresses/finalizers"]
  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests", "certificatesigningrequests/status", "signers"]
  verbs: ["get", "list", "watch", "update", "patch", "sign"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core", "cert-manager-controller"]
  verbs: ["create", "get", "update", "patch"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["create"]
# Additional rules for trust-manager
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "create", "patch", "watch", "delete", "update"]
- apiGroups: ["trust.cert-manager.io"]
  resources: ["bundles"]
  verbs: ["get", "list", "watch", "patch", "update"]
- apiGroups: ["trust.cert-manager.io"]
  resources: ["bundles/status"]
  verbs: ["patch"]
- apiGroups: ["trust.cert-manager.io"]
  resources: ["bundles/finalizers"]
  verbs: ["update"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingressclasses"]
  verbs: ["delete", "get", "list", "watch", "create"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list", "watch", "get"]
- apiGroups: ["discovery.k8s.io"]
  resources: ["endpointslices"]
  verbs: ["list", "get", "watch"]
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["list", "watch"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["list", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses/status"]
  verbs: ["update"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles", "clusterrolebindings"]
  verbs: ["delete"]
#Additional rules required for obcerv-operator
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["patch"]
- apiGroups: [""]
  resources: ["nodes/proxy"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings"]
  verbs: ["update", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs: ["update", "patch"]
#Additional rules for linkerd
- apiGroups: [""]
  resources: ["replicationcontrollers", "endpoints"]
  verbs: ["list", "get", "watch", "create", "patch"]
- apiGroups: ["apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions"]
  resources: ["cronjobs", "daemonsets", "deployments", "jobs", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["create", "get", "patch"]
- apiGroups: ["policy.linkerd.io"]
  resources: ["authorizationpolicies", "httproutes", "meshtlsauthentications", "networkauthentications", "serverauthorizations", "servers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["create"]
- apiGroups: ["gateway.networking.k8s.io"]
  resources: ["httproutes/status"]
  verbs: ["patch"]
- apiGroups: ["policy.linkerd.io"]
  resources: ["httproutes/status"]
  verbs: ["patch"]
- apiGroups: ["trust.cert-manager.io"]
  resources: ["bundles"]
  verbs: ["create", "delete"]
#Additional rules required by kots config
- apiGroups: ["apps"]
  resources: ["deployments", "statefulsets"]
  verbs: ["get"]
#Additional roles required by kotsadm for linkerd namespace <kotsadm namespace>-linkerd
---
apiVersion: v1
kind: Namespace
metadata:
  name: itrs-linkerd

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kotsadm-role-linkerd
  namespace: itrs-linkerd
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kotsadm-rolebinding-linkerd
  namespace: itrs-linkerd
subjects:
  - kind: ServiceAccount
    name: kotsadm
    namespace: itrs
roleRef:
  kind: Role
  name: kotsadm-role-linkerd
  apiGroup: rbac.authorization.k8s.io