rbac.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: kopfexample-account
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: kopfexample-role-cluster
rules:

  # Framework: knowing which other operators are running (i.e. peering).
  - apiGroups: [jicomusic.com]
    resources: [clusterkopfpeerings]
    verbs: [list, watch, patch, get]
  - apiGroups: [apiextensions.k8s.io]
    resources: [customresourcedefinitions]
    verbs: [list, get]

  - apiGroups: [jicomusic.com]
    resources: [iamgroups]
    verbs: ['*']
  - apiGroups: [events.k8s.io]
    resources: [events]
    verbs: [create]
  - apiGroups: [""]
    resources: [events]
    verbs: [create]
  - apiGroups: [""]
    resources: [configmaps]
    verbs: [patch, get, post, update, create]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kopfexample-rolebinding-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kopfexample-role-cluster
subjects:
  - kind: ServiceAccount
    name: kopfexample-account
    namespace: default
  - kind: ServiceAccount
    name: iamreader
    namespace: default