apiVersion: v1
kind: ServiceAccount
metadata:
  name: machine-api-operator
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: machine-api-controllers
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: machine-api-termination-handler
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
automountServiceAccountToken: false

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: machine-api-controllers
  namespace: openshift-config
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: machine-api-controllers
  namespace: openshift-config-managed
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: machine-api-controllers
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:

  - apiGroups:
      - machine.openshift.io
    resources:
      - '*'
    verbs:
      - '*'

  - apiGroups:
      - healthchecking.openshift.io
    resources:
      - '*'
    verbs:
      - '*'

  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - watch
      - list
      - patch

  - apiGroups:
      - metal3.io
    resources:
      - baremetalhosts
    verbs:
      - get
      - list
      - watch
      - update
      - patch

  - apiGroups:
      - metal3.io
    resources:
      - baremetalhosts/status
      - baremetalhosts/finalizers
    verbs:
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: machine-api-controllers
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:

  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - ""
    resources:
      - pods/eviction
    verbs:
      - create

  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create

  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create

# TODO(vikasc): Remove extensions/daemonsets permissions once all controllers have bumped kubernetes-drain
  - apiGroups:
      - extensions
    resources:
      - daemonsets
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - apps
    resources:
      - daemonsets
    verbs:
      - get
      - list
      - watch

  - apiGroups:
    - config.openshift.io
    resources:
    - infrastructures
    - dnses
    verbs:
    - get
    - list
    - watch

# The baremetal controller needs access to rendered-ignition
  - apiGroups:
      - machineconfiguration.openshift.io
    resources:
      - machineconfigs
      - machineconfigpools
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: machine-api-operator
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:

  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  - apiGroups:
      - machine.openshift.io
    resources:
      - '*'
    verbs:
      - list
      - watch

  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - create

  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - create
      - watch
      - get
      - list
      - patch

  - apiGroups:
      - "monitoring.coreos.com"
    resources:
      - servicemonitors
    verbs:
      - create
      - watch
      - get
      - list
      - patch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: machine-api-operator
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
  - apiGroups: ["authentication.k8s.io"]
    resources:
      - tokenreviews
    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources:
      - subjectaccessreviews
    verbs: ["create"]
  - apiGroups:
      - config.openshift.io
    resources:
      - clusteroperators
      - clusteroperators/status
    verbs:
      - create
      - get
      - update

  - apiGroups:
      - config.openshift.io
    resources:
      - infrastructures
      - infrastructures/status
    verbs:
      - get

  - apiGroups:
      - config.openshift.io
    resources:
      - featuregates
      - featuregates/status
      - proxies
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - watch
      - list
      - patch

  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
      - mutatingwebhookconfigurations
    verbs:
      - get
      - list
      - watch
      - create
      - update

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: machine-api-controllers
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: machine-api-controllers
subjects:
  - kind: ServiceAccount
    name: machine-api-controllers
    namespace: openshift-machine-api

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: machine-api-controllers
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: machine-api-controllers
subjects:
  - kind: ServiceAccount
    name: machine-api-controllers
    namespace: openshift-machine-api

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: machine-api-controllers
  namespace: openshift-config
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: machine-api-controllers
subjects:
  - kind: ServiceAccount
    name: machine-api-controllers
    namespace: openshift-machine-api

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: machine-api-controllers
  namespace: openshift-config-managed
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: machine-api-controllers
subjects:
- kind: ServiceAccount
  name: machine-api-controllers
  namespace: openshift-machine-api

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: machine-api-operator
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: machine-api-operator
subjects:
  - kind: ServiceAccount
    name: machine-api-operator
    namespace: openshift-machine-api

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: machine-api-operator
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: machine-api-operator
subjects:
  - kind: ServiceAccount
    name: machine-api-operator
    namespace: openshift-machine-api

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: prometheus-k8s-machine-api-operator
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: prometheus-k8s-machine-api-operator
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring

---
# Roles needed by prometheus to scrape machine api Operator metrics endpoint
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: prometheus-k8s-machine-api-operator
  namespace: openshift-machine-api
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
  - apiGroups:
      - ""
    resources:
      - namespace/metrics
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - pods
    verbs:
      - get
      - list
      - watch
---
# Cluster-reader extension to view machine machine.openshift.io resources
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: machine-api-operator:cluster-reader
  labels:
    rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    include.release.openshift.io/single-node-developer: "true"
rules:
- apiGroups:
  - machine.openshift.io
  resources:
  - machinehealthchecks
  - machines
  - machinesets
  verbs:
  - get
  - list
  - watch
