kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: acorn-system
rules:
  - verbs: ["*"]
    apiGroups:
      - api.acorn.io
      - internal.acorn.io
      - admin.acorn.io
      - internal.admin.acorn.io
    resources: ["*"]
  - verbs: ["*"]
    apiGroups: [""]
    resources:
      - pods
      - pods/exec
      - pods/log
      - pods/portforward
      - pods/ephemeralcontainers
      - configmaps
      - secrets
      - namespaces
      - services
      - endpoints
      - serviceaccounts
      - persistentvolumes
      - persistentvolumeclaims
  - verbs: ["get", "list", "watch"]
    apiGroups: [""]
    resources:
      - nodes
  - verbs: ["*"]
    apiGroups: ["apiextensions.k8s.io"]
    resources:
      - customresourcedefinitions
  - verbs: ["*"]
    apiGroups: ["apiregistration.k8s.io"]
    resources:
      - apiservices
  - verbs: ["*"]
    apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
      - networkpolicies
  - verbs: ["get", "list", "watch"]
    apiGroups: ["networking.k8s.io"]
    resources:
    - ingressclasses
  - verbs: ["*"]
    apiGroups: ["batch"]
    resources:
      - jobs
      - cronjobs
      - cronjobs/status
  - verbs: ["*"]
    apiGroups: ["apps"]
    resources:
      - deployments
      - daemonsets
      - replicasets
  - verbs: ["create"]
    apiGroups: ["authorization.k8s.io"]
    resources:
      - subjectaccessreviews
  - verbs: ["*"]
    apiGroups: ["rbac.authorization.k8s.io"]
    resources:
      - clusterroles
      - roles
      - clusterrolebindings
      - rolebindings
  - verbs: ["*"]
    apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
  - verbs: ["*"]
    apiGroups: ["policy"]
    resources: ["poddisruptionbudgets"]
  - verbs: ["get", "list", "watch"]
    apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
  - verbs: ["get", "list", "watch"]
    apiGroups: ["scheduling.k8s.io"]
    resources: ["priorityclasses"]
  - apiGroups: ["management.cattle.io"]
    resources: ["projects"]
    verbs: ["updatepsa"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: acorn-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: acorn-system
subjects:
  - kind: ServiceAccount
    namespace: acorn-system
    name: acorn-system
