---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kk-operator
  namespace: {{ .Release.Namespace }}
  labels: {{- include "common.labels" . | nindent 4 }}
rules:
- apiGroups:
    - kubekey.kubesphere.io
  resources:
    - configs
    - inventories
  verbs:
    - get
    - list
    - watch
- apiGroups:
    - kubekey.kubesphere.io
  resources:
    - pipelines
    - pipelines/status
  verbs:
    - "*"
- apiGroups:
    - coordination.k8s.io
  resources:
    - leases
  verbs:
    - "*"
- apiGroups:
    - ""
  resources:
    - events
  verbs:
    - "*"
- apiGroups:
    - batch
  resources:
    - jobs
    - cronjobs
  verbs:
    - get
    - list
    - watch
    - create
    - update
- apiGroups:
    - ""
  resources:
    - serviceaccounts
  verbs:
    - get
    - list
    - watch
    - create
- apiGroups:
    - "rbac.authorization.k8s.io"
  resources:
    - clusterrolebindings
  verbs:
    - get
    - list
    - watch
    - create

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kk-executor
  namespace: {{ .Release.Namespace }}
  labels: {{- include "common.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - kubekey.kubesphere.io
    resources:
      - configs
      - inventories
      - pipelines
    verbs:
      - get
      - list
  - apiGroups:
      - kubekey.kubesphere.io
    resources:
      - pipelines/status
    verbs:
      - update
      - patch
