# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: knative-serving-operator-aggregated
  labels:
    operator.knative.dev/release: devel
aggregationRule:
  clusterRoleSelectors:
# This (along with escalate below) allows the Operator to pick up any
# roles that are provided to the admin of the cluster by knative serving
# automatically.
  - matchExpressions:
      - {key: serving.knative.dev/release, operator: Exists}
rules: [] # Rules are automatically filled in by the controller manager.
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: knative-serving-operator
  labels:
    operator.knative.dev/release: devel
rules:
- apiGroups:
  - operator.knative.dev
  resources:
  - '*'
  verbs:
  - '*'
# Bootstrapping permissions.
# Roles that are explicitly bound buch which are specified by this Operator
# MUST be specified here with 'get' and 'bind'.
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterroles
  resourceNames:
  - system:auth-delegator
  verbs:
  - bind
  - get
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - roles
  resourceNames:
  - extension-apiserver-authentication-reader
  verbs:
  - bind
  - get
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterroles
  - roles
  verbs:
  - create
  - delete
# Escalate is necessary in order to create a role using cluster role aggregation,
# and to allow the Operator to bootstrap itself into the necessary set of
# permissions, even as those continue to evolve upstream.
  - escalate
  - get
  - list
  - update
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - rolebindings
  verbs:
  - create
  - delete
  - list
  - get
  - update
# Permissions required for Knative controller
# infra.
- apiGroups:
  - apiregistration.k8s.io
  resources:
  - apiservices
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - caching.internal.knative.dev
  resources:
  - images
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - update
  - watch
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - update
  - patch
- apiGroups:
  - ''
  resources:
  - configmaps
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - replicasets
  - statefulsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - apiregistration.k8s.io
  resources:
  - apiservices
  verbs:
  - create
  - delete
  - get
  - list
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - create
  - delete
  - get
  - list
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - '*'
# Old resources that need cleaning up that are not in the knative-serving
# namespace.
- apiGroups:
  - ""
  resources:
  - services
  - deployments
  - horizontalpodautoscalers
  resourceNames:
  - knative-ingressgateway
  verbs:
  - delete
- apiGroups:
  - ""
  resources:
  - configmaps
  resourceNames:
  - config-controller
  verbs:
  - delete
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  resourceNames:
  - knative-serving-operator
  verbs:
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: knative-eventing-operator-aggregated
  labels:
    operator.knative.dev/release: devel
aggregationRule:
  clusterRoleSelectors:
    # This (along with escalate below) allows the Operator to pick up any
    # roles that are provided to the admin of the cluster by knative eventing
    # automatically.
    - matchExpressions:
        - {key: eventing.knative.dev/release, operator: Exists}
rules: [] # Rules are automatically filled in by the controller manager.
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: knative-eventing-operator
  labels:
    operator.knative.dev/release: devel
rules:
  - apiGroups:
      - operator.knative.dev
    resources:
      - '*'
    verbs:
      - '*'
  # Bootstrapping permissions.
  # Roles that are explicitly bound buch which are specified by this Operator
  # MUST be specified here with 'get' and 'bind'.
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterroles
      - roles
    verbs:
      - create
      - delete
      # Escalate is necessary in order to create a role using cluster role aggregation,
      # and to allow the Operator to bootstrap itself into the necessary set of
      # permissions, even as those continue to evolve upstream.
      - escalate
      - get
      - list
      - update
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterrolebindings
      - rolebindings
    verbs:
      - create
      - delete
      - list
      - get
      - update
  # Permissions required for Knative controller
  # infra.
  - apiGroups:
      - apiregistration.k8s.io
    resources:
      - apiservices
    verbs:
      - update
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - caching.internal.knative.dev
    resources:
      - images
    verbs:
      - '*'
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
      - update
      - watch
  - apiGroups:
      - ''
    resources:
      - events
    verbs:
      - create
      - update
      - patch
  - apiGroups:
      - ''
    resources:
      - configmaps
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - apiregistration.k8s.io
    resources:
      - apiservices
    verbs:
      - create
      - delete
      - get
      - list
  - apiGroups:
      - autoscaling
    resources:
      - horizontalpodautoscalers
    verbs:
      - create
      - delete
      - update
      - get
      - list
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - '*'
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - '*'
  - apiGroups:
      - batch
    resources:
      - jobs
    verbs:
      - create
      - delete
      - update
      - get
      - list
      - watch
# Old resources that need cleaning up that are not in the knative-eventing
# namespace.
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    resourceNames:
    - knative-eventing-operator
    verbs:
    - delete
