apiVersion: v1 kind: ServiceAccount metadata: name: zuul-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: zuul-operator rules: - apiGroups: - "" resources: - pods - pods/exec - services - services/finalizers - endpoints - persistentvolumeclaims - events - configmaps - secrets - ingresses - namespaces verbs: - create - delete - get - list - patch - update - watch - apiGroups: - apps resources: - deployments - daemonsets - replicasets - statefulsets verbs: - create - delete - get - list - patch - update - watch - apiGroups: - networking.k8s.io resources: - ingresses verbs: - create - delete - get - list - patch - update - watch - apiGroups: - policy resources: - poddisruptionbudgets verbs: - create - delete - get - list - patch - update - watch - apiGroups: - apps resourceNames: - zuul-operator resources: - deployments/finalizers verbs: - update - apiGroups: - apps resources: - replicasets - deployments verbs: - get - apiGroups: - operator.zuul-ci.org - cert-manager.io - pxc.percona.com resources: - '*' verbs: - create - delete - get - list - patch - update - watch - apiGroups: - monitoring.coreos.com resources: - servicemonitors verbs: - get - create --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: zuul-operator subjects: - kind: ServiceAccount name: zuul-operator namespace: default roleRef: kind: ClusterRole name: cluster-admin #zuul-operator apiGroup: rbac.authorization.k8s.io