apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8s-mgmt-pod
rules:
  - apiGroups: [""]
    resources:
      - configmaps
      - endpoints
      - events
      - limitranges
      - namespaces
      - nodes
      - persistentvolumeclaims
      - persistentvolumes
      - pods
      - pods/log
      - pods/portforward
      - pods/proxy
      - replicationcontrollers
      - replicationcontrollers/scale
      - resourcequotas
      - serviceaccounts
      - services
      - services/proxy
    verbs: ["*"]
  - apiGroups: ["apps"]
    resources:
      - controllerrevisions
      - daemonsets
      - deployments
      - deployments/scale
      - replicasets
      - replicasets/scale
      - statefulsets
      - statefulsets/scale
    verbs: ["*"]
  - apiGroups: ["batch"]
    resources:
      - cronjobs
      - jobs
    verbs: ["*"]
  - apiGroups: ["autoscaling"]
    resources:
      - horizontalpodautoscalers
    verbs: ["*"]
  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingressclasses
      - ingresses
    verbs: ["*"]
  - apiGroups: ["extensions"]
    resources:
      - ingresses
    verbs: ["*"]
  - apiGroups: ["policy"]
    resources:
      - poddisruptionbudgets
    verbs: ["*"]
  - apiGroups: ["coordination.k8s.io"]
    resources:
      - leases
    verbs: ["*"]
  - apiGroups: ["storage.k8s.io"]
    resources:
      - csidrivers
      - csinodes
      - csistoragecapacities
      - storageclasses
      - volumeattachments
    verbs: ["*"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources:
      - customresourcedefinitions
    verbs: ["*"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources:
      - mutatingadmissionpolicies
      - mutatingwebhookconfigurations
      - validatingadmissionpolicies
      - validatingwebhookconfigurations
    verbs: ["*"]
  - apiGroups: ["metrics.k8s.io"]
    resources:
      - nodes
      - pods
    verbs: ["get", "list", "watch"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources:
      - gatewayclasses
      - gateways
      - httproutes
      - referencegrants
      - tcproutes
      - tlsroutes
      - udproutes
    verbs: ["*"]
  - apiGroups: ["cert-manager.io"]
    resources:
      - certificates
      - certificaterequests
      - clusterissuers
      - issuers
    verbs: ["*"]
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - alertmanagers
      - podmonitors
      - prometheuses
      - prometheusrules
      - servicemonitors
      - thanosrulers
    verbs: ["*"]
  - apiGroups: ["argoproj.io"]
    resources:
      - applications
      - appprojects
    verbs: ["*"]
  - apiGroups: ["traefik.containo.us", "traefik.io"]
    resources:
      - ingressroutes
      - middlewares
      - traefikservices
    verbs: ["*"]
  - apiGroups: ["k8s.cni.cncf.io"]
    resources:
      - network-attachment-definitions
    verbs: ["*"]
  - apiGroups: ["kubevirt.io"]
    resources:
      - virtualmachineinstances
      - virtualmachines
    verbs: ["*"]
  - apiGroups: ["subresources.kubevirt.io"]
    resources:
      - "*"
    verbs: ["*"]
  - apiGroups: ["instancetype.kubevirt.io"]
    resources:
      - "*"
    verbs: ["*"]
  - apiGroups: ["cdi.kubevirt.io"]
    resources:
      - "*"
    verbs: ["*"]
  - apiGroups: ["pool.kubevirt.io"]
    resources:
      - "*"
    verbs: ["*"]
  - apiGroups: ["cluster.x-k8s.io"]
    resources:
      - clusters
      - machinedeployments
      - machinepools
      - machines
      - machinesets
    verbs: ["*"]
  - apiGroups: ["controlplane.cluster.x-k8s.io"]
    resources:
      - kubeadmcontrolplanes
    verbs: ["*"]
  - apiGroups: ["bootstrap.cluster.x-k8s.io"]
    resources:
      - kubeadmconfigs
      - kubeadmconfigtemplates
    verbs: ["*"]
  - apiGroups: ["infrastructure.cluster.x-k8s.io"]
    resources:
      - kubevirtclusters
      - kubevirtmachinetemplates
    verbs: ["*"]
  - apiGroups: ["addons.cluster.x-k8s.io"]
    resources:
      - clusterresourcesets
    verbs: ["*"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8s-mgmt-pod-access
subjects:
  - kind: ServiceAccount
    name: k8s-mgmt-pod
    namespace: k8s-mgmt-pod
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8s-mgmt-pod