apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kubeslice-api-gw
rules:
  - verbs:
      - get
      - list
    apiGroups:
      - controller.kubeslice.io
      - worker.kubeslice.io
    resources:
      - projects
      - clusters
  - verbs:
      - get
      - list
    apiGroups:
      - ""
      - events.k8s.io/v1
    resources:
      - secrets
      - events
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubeslice-api-gw
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubeslice-api-gw
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeslice-api-gw
subjects:
  - kind: ServiceAccount
    name: kubeslice-api-gw
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeslice-api-gw
rules:
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - list
      - get

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubeslice-api-gw
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubeslice-api-gw
subjects:
  - kind: ServiceAccount
    name: kubeslice-api-gw
    namespace: kubeslice-controller