apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: amq-streams-installer-clusterrole
rules:
  # ClusterRoles and ClusterRoleBindings for the controllers of the extension
  - apiGroups:
    - rbac.authorization.k8s.io
    resources:
    - clusterroles
    verbs:
    - "*"
  - apiGroups:
    - rbac.authorization.k8s.io
    resources:
    - clusterrolebindings
    verbs:
    - "*"
  - apiGroups:
    - olm.operatorframework.io
    resources:
    - clusterextensions/finalizers
    verbs:
    - update
    # Scoped to the name of the ClusterExtension
    resourceNames:
    - amq-streams # the value from <metadata.name> from the extension's custom resource (CR)
  # Deployments specified in install.spec.deployments
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - create
    - list
    - watch
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - get
    - update
    - patch
    - delete
    # scoped to the extension controller deployment name
    resourceNames:
    - amq-streams-cluster-operator
    - amq-streams-cluster-operator-v2.9.0-0
  # Service accounts in the CSV
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    verbs:
    - create
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    verbs:
    - get
    - update
    - patch
    - delete
    # scoped to the extension controller's deployment service account
    resourceNames:
    - strimzi-cluster-operator
  # configmaps
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - create
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - get
    - list
    - watch
    - update
    - patch
    - delete
    # scoped to the configmap name
    resourceNames:
    - strimzi-cluster-operator
  - apiGroups:
    - apiextensions.k8s.io
    resources:
    - customresourcedefinitions
    verbs:
    - create
    - list
    - watch
  - apiGroups:
    - apiextensions.k8s.io
    resources:
    - customresourcedefinitions
    verbs:
    - get
    - update
    - patch
    - delete
    resourceNames:
    - kafkas.kafka.strimzi.io
    - kafkanodepools.kafka.strimzi.io
    - kafkaconnects.kafka.strimzi.io
    - kafkamirrormakers.kafka.strimzi.io
    - kafkabridges.kafka.strimzi.io
    - kafkatopics.kafka.strimzi.io
    - kafkausers.kafka.strimzi.io
    - kafkaconnectors.kafka.strimzi.io
    - kafkamirrormaker2s.kafka.strimzi.io
    - kafkarebalances.kafka.strimzi.io
    - strimzipodsets.core.strimzi.io
  # install permissions from CSV
  - apiGroups:
    - "rbac.authorization.k8s.io"
    resources:
      # The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions
    - rolebindings
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - "rbac.authorization.k8s.io"
    resources:
      # The cluster operator needs to access and manage roles to grant the entity operator permissions
    - roles
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - ""
    resources:
      # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
    - pods
      # The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions
    - serviceaccounts
      # The cluster operator needs to access and manage config maps for Strimzi components configuration
    - configmaps
      # The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic
    - services
    - endpoints
      # The cluster operator needs to access and manage secrets to handle credentials
      # The entity operator user-operator needs to access and manage secrets to store generated credentials
    - secrets
      # The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data
    - persistentvolumeclaims
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - "kafka.strimzi.io"
    resources:
      # The Cluster Operator operates the Strimzi custom resources
    - kafkas
    - kafkanodepools
    - kafkaconnects
    - kafkaconnectors
    - kafkamirrormakers
    - kafkabridges
    - kafkamirrormaker2s
    - kafkarebalances
    - kafkatopics
    - kafkausers
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - "kafka.strimzi.io"
    resources:
      # The Cluster Operator needs to manage the status of the Strimzi custom resources
    - kafkas/status
    - kafkanodepools/status
    - kafkaconnects/status
    - kafkaconnectors/status
    - kafkamirrormakers/status
    - kafkabridges/status
    - kafkamirrormaker2s/status
    - kafkarebalances/status
    - kafkatopics/status
    - kafkausers/status
    verbs:
    - get
    - patch
    - update
  - apiGroups:
    - "core.strimzi.io"
    resources:
      # The cluster operator uses StrimziPodSets to manage the Kafka and ZooKeeper pods
    - strimzipodsets
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - "core.strimzi.io"
    resources:
      # The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
    - strimzipodsets/status
    verbs:
    - get
    - patch
    - update
  - apiGroups:
    - "kafka.strimzi.io"
    resources:
      # The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
    - kafkarebalances
    verbs:
    - delete
  - apiGroups:
    - "apps"
    resources:
      # The cluster operator needs to access and manage deployments to run deployment based Strimzi components
    - deployments
      # The cluster operator needs to access and manage stateful sets to run stateful sets based Strimzi components
    - statefulsets
      # The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states
    - replicasets
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - "apps"
    resources:
      # The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets
    - deployments/scale
    verbs:
    - get
    - patch
    - update
  - apiGroups:
    - ""   # legacy core events api, used by topic operator
    - "events.k8s.io"   # new events api, used by cluster operator
    resources:
    - events
    verbs:
    - create
  - apiGroups:
      # Kafka Connect Build on OpenShift requirement
    - build.openshift.io
    resources:
    - buildconfigs
    - buildconfigs/instantiate
    - builds
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - networking.k8s.io
    resources:
      # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
    - networkpolicies
      # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
    - ingresses
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - route.openshift.io
    resources:
      # The cluster operator needs to access and manage routes to expose Strimzi components for external access
    - routes
    - routes/custom-host
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - image.openshift.io
    resources:
      # The cluster operator needs to verify the image stream when used for Kafka Connect image build
    - imagestreams
    verbs:
    - get
  - apiGroups:
    - policy
    resources:
      # The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions
      # that a Streams component experiences, allowing for higher availability
    - poddisruptionbudgets
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - coordination.k8s.io
    resources:
      # The cluster operator needs to access and manage leases for leader election
      # The "create" verb cannot be used with "resourceNames"
    - leases
    verbs:
    - create
  - apiGroups:
    - coordination.k8s.io
    resources:
      # The cluster operator needs to access and manage leases for leader election
    - leases
    resourceNames:
      # The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator
      # If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly
    - strimzi-cluster-operator
    verbs:
    - get
    - list
    - watch
    - delete
    - patch
    - update
  # Cluster permissions from CSV
  - apiGroups:
    - "rbac.authorization.k8s.io"
    resources:
    # The cluster operator needs to create and manage cluster role bindings in the case of an install where a user
    # has specified they want their cluster role bindings generated
    - clusterrolebindings
    verbs:
    - get
    - list
    - watch
    - create
    - delete
    - patch
    - update
  - apiGroups:
    - storage.k8s.io
    resources:
    # The cluster operator requires "get" permissions to view storage class details
    # This is because only a persistent volume of a supported storage class type can be resized
    - storageclasses
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    # The cluster operator requires "list" permissions to view all nodes in a cluster
    # The listing is used to determine the node addresses when NodePort access is configured
    # These addresses are then exposed in the custom resource states
    # The Kafka Brokers require "get" permissions to view the node they are on
    # This information is used to generate a Rack ID that is used for High Availability configurations
    - nodes
    verbs:
    - get
    - list