---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: machine-api-controllers
rules:
  - apiGroups:
      - cluster.k8s.io
    resources:
      - '*'
    verbs:
      - '*'

  - apiGroups:
      - machine.openshift.io
    resources:
      - '*'
    verbs:
      - '*'

  - apiGroups:
      - healthchecking.openshift.io
    resources:
      - '*'
    verbs:
      - '*'

  - apiGroups:
      - config.openshift.io
    resources:
      - clusteroperators
      - clusteroperators/status
    verbs:
      - create
      - get
      - update

  - apiGroups:
      - config.openshift.io
    resources:
      - infrastructures
      - infrastructures/status
    verbs:
      - get

  - apiGroups:
      - config.openshift.io
    resources:
      - featuregates
      - featuregates/status
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - metalkube.org
    resources:
      - baremetalhosts
    verbs:
      - get
      - list
      - watch
      - update
      - patch

  - apiGroups:
      - metal3.io
    resources:
      - baremetalhosts
    verbs:
      - get
      - list
      - watch
      - update
      - patch

  - apiGroups:
      - apps
    resources:
      - deployments
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - watch
      - list
      - patch

  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
      - create

  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
      - watch
      # Only these two additional lines are needed for kubemark actuator to
      # create and remove kubemark instances
      - create
      - delete

  - apiGroups:
      - ""
    resources:
      - pods/eviction
    verbs:
      - create

  - apiGroups:
      - extensions
      - apps
    resources:
      - daemonsets
    verbs:
      - get
      - list
      - watch
