apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: k8s-mgmt-pod
rules:
  # This is intentionally broader than the strict minimum so lfk and kubectl are usable.
  # Scope it down to the smallest verb and resource set your operators actually need.
  - apiGroups: [""]
    resources:
      - configmaps
      - endpoints
      - events
      - persistentvolumeclaims
      - pods
      - pods/exec
      - pods/log
      - secrets
      - serviceaccounts
      - services
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["apps"]
    resources:
      - daemonsets
      - deployments
      - replicasets
      - statefulsets
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["batch"]
    resources:
      - cronjobs
      - jobs
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
      - networkpolicies
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: k8s-mgmt-pod
subjects:
  - kind: ServiceAccount
    name: k8s-mgmt-pod
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: k8s-mgmt-pod