# to delegate authentication and authorization
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: auth-delegator-cluster-resource-override
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    namespace: cluster-resource-override
    name: clusterresourceoverride
---
# to let aggregated apiservers create admission reviews
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: system:clusterresourceoverride-requester
rules:
  - apiGroups:
      - autoscaling.openshift.io
    resources:
      - clusterresourceoverride
    verbs:
      - create
---
# to read the config for terminating authentication
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: kube-system
  name: extension-server-authentication-reader-clusterresourceoverride
roleRef:
  kind: Role
  apiGroup: rbac.authorization.k8s.io
  name: extension-apiserver-authentication-reader
subjects:
  - kind: ServiceAccount
    namespace: cluster-resource-override
    name: clusterresourceoverride
---
# this should be a default for an aggregated apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: should-be-default-for-aggregated-apiserver
rules:
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
      - mutatingwebhookconfigurations
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - limitranges
    verbs:
      - get
      - list
      - watch
---
# this should be a default for an aggregated apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: should-be-default-for-aggregated-apiserver
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: should-be-default-for-aggregated-apiserver
subjects:
  - kind: ServiceAccount
    namespace: cluster-resource-override
    name: clusterresourceoverride

