kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: console-operator
  namespace: openshift-config-managed
  annotations:
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  # We cannot restrict create or deletecollection requests by resourceName.
  # For create, this limitation is because the object name is not known at authorization time.
  # Check: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources
  - create
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  resourceNames:
  - console-public
  verbs:
  - update
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: console-public
  namespace: openshift-config-managed
  annotations:
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  resourceNames:
  - console-public
  verbs:
  - get
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: console-configmap-reader
  namespace: openshift-config-managed
  annotations:
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
