bootstrap_cluster_roles.yaml

apiVersion: v1
items:
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      openshift.io/description: A super-user that can perform any action in the cluster.
        When granted to a user within a project, they have full control over quota
        and membership and can perform every action on every resource in the project.
    creationTimestamp: null
    name: cluster-admin
  rules:
  - apiGroups:
    - '*'
    attributeRestrictions: null
    resources:
    - '*'
    verbs:
    - '*'
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - '*'
    resources: []
    verbs:
    - '*'
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: sudoer
  rules:
  - apiGroups:
    - user.openshift.io
    - ""
    attributeRestrictions: null
    resourceNames:
    - system:admin
    resources:
    - systemusers
    verbs:
    - impersonate
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: cluster-reader
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - bindings
    - componentstatuses
    - configmaps
    - endpoints
    - events
    - limitranges
    - namespaces
    - namespaces/status
    - nodes
    - nodes/status
    - persistentvolumeclaims
    - persistentvolumeclaims/status
    - persistentvolumes
    - persistentvolumes/status
    - pods
    - pods/binding
    - pods/eviction
    - pods/log
    - pods/status
    - podtemplates
    - replicationcontrollers
    - replicationcontrollers/scale
    - replicationcontrollers/status
    - resourcequotas
    - resourcequotas/status
    - securitycontextconstraints
    - serviceaccounts
    - services
    - services/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/scale
    - deployments/status
    - statefulsets
    - statefulsets/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - autoscaling
    attributeRestrictions: null
    resources:
    - horizontalpodautoscalers
    - horizontalpodautoscalers/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs
    - cronjobs/status
    - jobs
    - jobs/status
    - scheduledjobs
    - scheduledjobs/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets
    - daemonsets/status
    - deployments
    - deployments/scale
    - deployments/status
    - horizontalpodautoscalers
    - horizontalpodautoscalers/status
    - ingresses
    - ingresses/status
    - jobs
    - jobs/status
    - networkpolicies
    - podsecuritypolicies
    - replicasets
    - replicasets/scale
    - replicasets/status
    - replicationcontrollers
    - replicationcontrollers/scale
    - storageclasses
    - thirdpartyresources
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - policy
    attributeRestrictions: null
    resources:
    - poddisruptionbudgets
    - poddisruptionbudgets/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - rbac.authorization.k8s.io
    attributeRestrictions: null
    resources:
    - clusterrolebindings
    - clusterroles
    - rolebindings
    - roles
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - settings.k8s.io
    attributeRestrictions: null
    resources:
    - podpresets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - storage.k8s.io
    attributeRestrictions: null
    resources:
    - storageclasses
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - certificates.k8s.io
    attributeRestrictions: null
    resources:
    - certificatesigningrequests
    - certificatesigningrequests/approval
    - certificatesigningrequests/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - clusterpolicies
    - clusterpolicybindings
    - clusterrolebindings
    - clusterroles
    - policies
    - policybindings
    - rolebindingrestrictions
    - rolebindings
    - roles
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs
    - buildconfigs/webhooks
    - builds
    - builds/details
    - builds/log
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    - deploymentconfigs/log
    - deploymentconfigs/scale
    - deploymentconfigs/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    - imagesignatures
    - imagestreamimages
    - imagestreams
    - imagestreams/status
    - imagestreamtags
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
  - apiGroups:
    - oauth.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - oauthclientauthorizations
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projectrequests
    - projects
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - quota.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - appliedclusterresourcequotas
    - clusterresourcequotas
    - clusterresourcequotas/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes
    - routes/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - network.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - clusternetworks
    - egressnetworkpolicies
    - hostsubnets
    - netnamespaces
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - template.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - processedtemplates
    - templateconfigs
    - templateinstances
    - templates
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - user.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - groups
    - identities
    - useridentitymappings
    - users
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - localresourceaccessreviews
    - localsubjectaccessreviews
    - resourceaccessreviews
    - selfsubjectrulesreviews
    - subjectaccessreviews
    - subjectrulesreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - localsubjectaccessreviews
    - selfsubjectaccessreviews
    - subjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - authentication.k8s.io
    attributeRestrictions: null
    resources:
    - tokenreviews
    verbs:
    - create
  - apiGroups:
    - security.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - podsecuritypolicyreviews
    - podsecuritypolicyselfsubjectreviews
    - podsecuritypolicysubjectreviews
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/metrics
    - nodes/spec
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/stats
    verbs:
    - create
    - get
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - '*'
    resources: []
    verbs:
    - get
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildlogs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotausages
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: cluster-debugger
  rules:
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - /debug/pprof
    - /debug/pprof/*
    - /metrics
    resources: []
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:build-strategy-docker
  rules:
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/docker
    - builds/optimizeddocker
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:build-strategy-custom
  rules:
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/custom
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:build-strategy-source
  rules:
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/source
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:build-strategy-jenkinspipeline
  rules:
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/jenkinspipeline
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: storage-admin
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumes
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - storage.k8s.io
    attributeRestrictions: null
    resources:
    - storageclasses
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    - persistentvolumeclaims
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: A user that has edit rights within the project and
        can change the project's membership.
    creationTimestamp: null
    name: admin
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    - pods/attach
    - pods/exec
    - pods/portforward
    - pods/proxy
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    - endpoints
    - persistentvolumeclaims
    - replicationcontrollers
    - replicationcontrollers/scale
    - secrets
    - serviceaccounts
    - services
    - services/proxy
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - bindings
    - events
    - limitranges
    - namespaces
    - namespaces/status
    - pods/log
    - pods/status
    - replicationcontrollers/status
    - resourcequotas
    - resourcequotas/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - serviceaccounts
    verbs:
    - impersonate
  - apiGroups:
    - autoscaling
    attributeRestrictions: null
    resources:
    - horizontalpodautoscalers
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs
    - jobs
    - scheduledjobs
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/rollback
    - deployments/scale
    - horizontalpodautoscalers
    - jobs
    - replicasets
    - replicasets/scale
    - replicationcontrollers/scale
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/scale
    - deployments/status
    - statefulsets
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - rolebindings
    - roles
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - localresourceaccessreviews
    - localsubjectaccessreviews
    - subjectrulesreviews
    verbs:
    - create
  - apiGroups:
    - security.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - podsecuritypolicyreviews
    - podsecuritypolicyselfsubjectreviews
    - podsecuritypolicysubjectreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - localsubjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - policies
    - policybindings
    - rolebindingrestrictions
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs
    - buildconfigs/webhooks
    - builds
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/log
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs/instantiate
    - buildconfigs/instantiatebinary
    - builds/clone
    verbs:
    - create
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/details
    verbs:
    - update
  - apiGroups:
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - jenkins
    verbs:
    - admin
    - edit
    - view
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    - deploymentconfigs/scale
    - generatedeploymentconfigs
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigrollbacks
    - deploymentconfigs/instantiate
    - deploymentconfigs/rollback
    verbs:
    - create
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs/log
    - deploymentconfigs/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreammappings
    - imagestreams
    - imagestreams/secrets
    - imagestreamtags
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
    - update
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimports
    verbs:
    - create
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - delete
    - get
    - patch
    - update
  - apiGroups:
    - quota.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - appliedclusterresourcequotas
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/custom-host
    verbs:
    - create
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/status
    verbs:
    - update
  - apiGroups:
    - template.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - processedtemplates
    - templateconfigs
    - templateinstances
    - templates
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildlogs
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotausages
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - resourceaccessreviews
    - subjectaccessreviews
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: A user that can create and edit most objects in a
        project, but can not update the project's membership.
    creationTimestamp: null
    name: edit
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    - pods/attach
    - pods/exec
    - pods/portforward
    - pods/proxy
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    - endpoints
    - persistentvolumeclaims
    - replicationcontrollers
    - replicationcontrollers/scale
    - secrets
    - serviceaccounts
    - services
    - services/proxy
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - bindings
    - events
    - limitranges
    - namespaces
    - namespaces/status
    - pods/log
    - pods/status
    - replicationcontrollers/status
    - resourcequotas
    - resourcequotas/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - serviceaccounts
    verbs:
    - impersonate
  - apiGroups:
    - autoscaling
    attributeRestrictions: null
    resources:
    - horizontalpodautoscalers
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs
    - jobs
    - scheduledjobs
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/rollback
    - deployments/scale
    - horizontalpodautoscalers
    - jobs
    - replicasets
    - replicasets/scale
    - replicationcontrollers/scale
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/scale
    - deployments/status
    - statefulsets
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs
    - buildconfigs/webhooks
    - builds
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/log
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs/instantiate
    - buildconfigs/instantiatebinary
    - builds/clone
    verbs:
    - create
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/details
    verbs:
    - update
  - apiGroups:
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - jenkins
    verbs:
    - edit
    - view
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    - deploymentconfigs/scale
    - generatedeploymentconfigs
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigrollbacks
    - deploymentconfigs/instantiate
    - deploymentconfigs/rollback
    verbs:
    - create
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs/log
    - deploymentconfigs/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreammappings
    - imagestreams
    - imagestreams/secrets
    - imagestreamtags
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
    - update
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimports
    verbs:
    - create
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - get
  - apiGroups:
    - quota.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - appliedclusterresourcequotas
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/custom-host
    verbs:
    - create
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - template.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - processedtemplates
    - templateconfigs
    - templateinstances
    - templates
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildlogs
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotausages
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: A user who can view but not edit any resources within
        the project. They can not view secrets or membership.
    creationTimestamp: null
    name: view
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    - endpoints
    - persistentvolumeclaims
    - pods
    - replicationcontrollers
    - serviceaccounts
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - bindings
    - events
    - limitranges
    - namespaces
    - namespaces/status
    - pods/log
    - pods/status
    - replicationcontrollers/status
    - resourcequotas
    - resourcequotas/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - autoscaling
    attributeRestrictions: null
    resources:
    - horizontalpodautoscalers
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs
    - jobs
    - scheduledjobs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/scale
    - horizontalpodautoscalers
    - jobs
    - replicasets
    - replicasets/scale
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - deployments
    - deployments/scale
    - statefulsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs
    - buildconfigs/webhooks
    - builds
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/log
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - jenkins
    verbs:
    - view
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    - deploymentconfigs/scale
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs/log
    - deploymentconfigs/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreammappings
    - imagestreams
    - imagestreamtags
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - get
  - apiGroups:
    - quota.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - appliedclusterresourcequotas
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - template.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - processedtemplates
    - templateconfigs
    - templateinstances
    - templates
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildlogs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotausages
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: A user that can get basic information about projects.
    creationTimestamp: null
    name: basic-user
  rules:
  - apiGroups:
    - user.openshift.io
    - ""
    attributeRestrictions: null
    resourceNames:
    - "~"
    resources:
    - users
    verbs:
    - get
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projectrequests
    verbs:
    - list
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - clusterroles
    verbs:
    - get
    - list
  - apiGroups:
    - storage.k8s.io
    attributeRestrictions: null
    resources:
    - storageclasses
    verbs:
    - get
    - list
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - list
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - selfsubjectrulesreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - selfsubjectaccessreviews
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: self-access-reviewer
  rules:
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - selfsubjectrulesreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - selfsubjectaccessreviews
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      openshift.io/description: A user that can request projects.
    creationTimestamp: null
    name: self-provisioner
  rules:
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projectrequests
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      openshift.io/description: A user that can get basic cluster status information.
    creationTimestamp: null
    name: cluster-status
  rules:
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - /healthz
    - /healthz/*
    resources: []
    verbs:
    - get
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - /.well-known
    - /.well-known/*
    - /api
    - /api/*
    - /apis
    - /apis/*
    - /oapi
    - /oapi/*
    - /osapi
    - /osapi/
    - /swaggerapi
    - /swaggerapi/*
    - /version
    - /version/*
    resources: []
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:image-auditor
  rules:
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    verbs:
    - get
    - list
    - patch
    - update
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: Grants the right to pull images from within a project.
    creationTimestamp: null
    name: system:image-puller
  rules:
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: Grants the right to push and pull images from within
        a project.
    creationTimestamp: null
    name: system:image-pusher
  rules:
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: Grants the right to build, push and pull images from
        within a project.  Used primarily with service accounts for builds.
    creationTimestamp: null
    name: system:image-builder
  rules:
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
    - update
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams
    verbs:
    - create
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds/details
    verbs:
    - update
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - builds
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:image-pruner
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    - replicationcontrollers
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - limitranges
    verbs:
    - list
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs
    - builds
    verbs:
    - get
    - list
  - apiGroups:
    - apps.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    verbs:
    - get
    - list
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    verbs:
    - delete
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    - imagestreams
    verbs:
    - get
    - list
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/status
    verbs:
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:image-signer
  rules:
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    - imagestreams/layers
    verbs:
    - get
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagesignatures
    verbs:
    - create
    - delete
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      openshift.io/description: Grants the right to deploy within a project.  Used
        primarily with service accounts for automated deployments.
    creationTimestamp: null
    name: system:deployer
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - delete
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods/log
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - list
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamtags
    verbs:
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:master
  rules:
  - apiGroups:
    - '*'
    attributeRestrictions: null
    resources:
    - '*'
    verbs:
    - '*'
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - '*'
    resources: []
    verbs:
    - '*'
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:oauth-token-deleter
  rules:
  - apiGroups:
    - oauth.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - oauthaccesstokens
    - oauthauthorizetokens
    verbs:
    - delete
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:router
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes
    verbs:
    - list
    - watch
  - apiGroups:
    - route.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - routes/status
    verbs:
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:registry
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - limitranges
    - resourcequotas
    verbs:
    - list
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    - imagestreamtags
    verbs:
    - delete
    - get
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreams/secrets
    verbs:
    - get
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - images
    - imagestreams
    verbs:
    - get
    - update
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreammappings
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:node-proxier
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - services
    verbs:
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:node-admin
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - proxy
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/log
    - nodes/metrics
    - nodes/proxy
    - nodes/spec
    - nodes/stats
    verbs:
    - '*'
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:node-reader
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/metrics
    - nodes/spec
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/stats
    verbs:
    - create
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:node
  rules:
  - apiGroups:
    - authentication.k8s.io
    attributeRestrictions: null
    resources:
    - tokenreviews
    verbs:
    - create
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - localsubjectaccessreviews
    - subjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - localsubjectaccessreviews
    - subjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - create
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/status
    verbs:
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    - secrets
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    - persistentvolumes
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    verbs:
    - get
  - apiGroups:
    - certificates.k8s.io
    attributeRestrictions: null
    resources:
    - certificatesigningrequests
    verbs:
    - create
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:sdn-reader
  rules:
  - apiGroups:
    - network.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - egressnetworkpolicies
    - hostsubnets
    - netnamespaces
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    - nodes
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - networkpolicies
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - network.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - clusternetworks
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:sdn-manager
  rules:
  - apiGroups:
    - network.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - hostsubnets
    - netnamespaces
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - apiGroups:
    - network.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - clusternetworks
    verbs:
    - create
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:webhook
  rules:
  - apiGroups:
    - build.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - buildconfigs/webhooks
    verbs:
    - create
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:discovery
  rules:
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - /.well-known
    - /.well-known/*
    - /api
    - /api/*
    - /apis
    - /apis/*
    - /oapi
    - /oapi/*
    - /osapi
    - /osapi/
    - /swaggerapi
    - /swaggerapi/*
    - /version
    - /version/*
    resources: []
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:persistent-volume-provisioner
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumes
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - storage.k8s.io
    attributeRestrictions: null
    resources:
    - storageclasses
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - list
    - patch
    - update
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: registry-admin
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    - serviceaccounts
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreammappings
    - imagestreams
    - imagestreams/secrets
    - imagestreamtags
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimports
    verbs:
    - create
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
    - update
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - rolebindings
    - roles
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - localresourceaccessreviews
    - localsubjectaccessreviews
    - subjectrulesreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - localsubjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - policies
    - policybindings
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - get
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - delete
    - get
  - apiGroups:
    - authorization.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - resourceaccessreviews
    - subjectaccessreviews
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: registry-editor
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    - serviceaccounts
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreammappings
    - imagestreams
    - imagestreams/secrets
    - imagestreamtags
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimports
    verbs:
    - create
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - get
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: registry-viewer
  rules:
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreamimages
    - imagestreammappings
    - imagestreams
    - imagestreamtags
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - image.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - imagestreams/layers
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - get
  - apiGroups:
    - project.openshift.io
    - ""
    attributeRestrictions: null
    resources:
    - projects
    verbs:
    - get
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:templateservicebroker-client
  rules:
  - apiGroups: null
    attributeRestrictions: null
    nonResourceURLs:
    - /brokers/template.openshift.io/*
    resources: []
    verbs:
    - delete
    - get
    - put
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:replication-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:endpoint-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:replicaset-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:garbage-collector-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:job-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:hpa-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:daemonset-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:disruption-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:namespace-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:gc-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:certificate-signing-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:statefulset-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:build-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:deploymentconfig-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: system:deployment-controller
  rules: []
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:node-bootstrapper
  rules:
  - apiGroups:
    - certificates.k8s.io
    attributeRestrictions: null
    resources:
    - certificatesigningrequests
    verbs:
    - create
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:template-service-broker
  rules:
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - subjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - template.openshift.io
    attributeRestrictions: null
    resources:
    - brokertemplateinstances
    verbs:
    - create
    - delete
    - get
    - update
  - apiGroups:
    - template.openshift.io
    attributeRestrictions: null
    resources:
    - templateinstances
    verbs:
    - assign
    - create
    - delete
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - create
    - delete
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    verbs:
    - list
  - apiGroups:
    - route.openshift.io
    attributeRestrictions: null
    resources:
    - routes
    verbs:
    - list
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:build-controller
  rules:
  - apiGroups:
    - ""
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - builds
    verbs:
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - buildconfigs
    verbs:
    - get
  - apiGroups:
    - ""
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - builds/custom
    - builds/docker
    - builds/jenkinspipeline
    - builds/optimizeddocker
    - builds/source
    verbs:
    - create
  - apiGroups:
    - ""
    - image.openshift.io
    attributeRestrictions: null
    resources:
    - imagestreams
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:build-config-change-controller
  rules:
  - apiGroups:
    - ""
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - buildconfigs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - buildconfigs/instantiate
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:deployer-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - delete
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:deploymentconfig-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    - apps.openshift.io
    attributeRestrictions: null
    resources:
    - deploymentconfigs/status
    verbs:
    - update
  - apiGroups:
    - ""
    - apps.openshift.io
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:deployment-trigger-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    - apps.openshift.io
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    - image.openshift.io
    attributeRestrictions: null
    resources:
    - imagestreams
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    - apps.openshift.io
    attributeRestrictions: null
    resources:
    - deploymentconfigs/instantiate
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:template-instance-controller
  rules:
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - subjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - template.openshift.io
    attributeRestrictions: null
    resources:
    - subjectaccessreviews
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - template.openshift.io
    attributeRestrictions: null
    resources:
    - templateinstances/status
    verbs:
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:origin-namespace-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces/finalize
    - namespaces/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:serviceaccount-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - serviceaccounts
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:serviceaccount-pull-secrets-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - serviceaccounts
    verbs:
    - create
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:image-trigger-controller
  rules:
  - apiGroups:
    - ""
    - image.openshift.io
    attributeRestrictions: null
    resources:
    - imagestreams
    verbs:
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets
    verbs:
    - get
    - update
  - apiGroups:
    - apps
    - extensions
    attributeRestrictions: null
    resources:
    - deployments
    verbs:
    - get
    - update
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - statefulsets
    verbs:
    - get
    - update
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    - apps.openshift.io
    attributeRestrictions: null
    resources:
    - deploymentconfigs
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    - build.openshift.io
    attributeRestrictions: null
    resources:
    - buildconfigs/instantiate
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:service-serving-cert-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - create
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:image-import-controller
  rules:
  - apiGroups:
    - ""
    - image.openshift.io
    attributeRestrictions: null
    resources:
    - imagestreams
    verbs:
    - create
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    - image.openshift.io
    attributeRestrictions: null
    resources:
    - images
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    - image.openshift.io
    attributeRestrictions: null
    resources:
    - imagestreamimports
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:sdn-controller
  rules:
  - apiGroups:
    - ""
    - network.openshift.io
    attributeRestrictions: null
    resources:
    - clusternetworks
    verbs:
    - create
    - get
    - update
  - apiGroups:
    - ""
    - network.openshift.io
    attributeRestrictions: null
    resources:
    - egressnetworkpolicies
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    - network.openshift.io
    attributeRestrictions: null
    resources:
    - hostsubnets
    verbs:
    - create
    - delete
    - get
    - list
  - apiGroups:
    - ""
    - network.openshift.io
    attributeRestrictions: null
    resources:
    - netnamespaces
    verbs:
    - create
    - delete
    - get
    - list
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/status
    verbs:
    - update
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - networkPolicies
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:cluster-quota-reconciliation-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configMaps
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    - quota.openshift.io
    attributeRestrictions: null
    resources:
    - clusterresourcequotas/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:unidling-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - replicationcontrollers/scale
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - get
    - patch
    - update
  - apiGroups:
    - apps
    - extensions
    attributeRestrictions: null
    resources:
    - deployments/scale
    - replicasets/scale
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    - apps.openshift.io
    attributeRestrictions: null
    resources:
    - deploymentconfigs/scale
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:service-ingress-ip-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:pv-recycler-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumes
    verbs:
    - create
    - delete
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumes/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
    creationTimestamp: null
    name: system:openshift:controller:resourcequota-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotas/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotas
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - configmaps
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:attachdetach-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    - persistentvolumes
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/status
    verbs:
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:cronjob-controller
  rules:
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - jobs
    verbs:
    - create
    - delete
    - get
    - list
    - update
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - cronjobs/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - delete
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:daemon-set-controller
  rules:
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - daemonsets/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - list
    - patch
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods/binding
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:deployment-controller
  rules:
  - apiGroups:
    - apps
    - extensions
    attributeRestrictions: null
    resources:
    - deployments
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - apps
    - extensions
    attributeRestrictions: null
    resources:
    - deployments/status
    verbs:
    - update
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - replicasets
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:disruption-controller
  rules:
  - apiGroups:
    - apps
    - extensions
    attributeRestrictions: null
    resources:
    - deployments
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - replicasets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - policy
    attributeRestrictions: null
    resources:
    - poddisruptionbudgets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - statefulsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - policy
    attributeRestrictions: null
    resources:
    - poddisruptionbudgets/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:endpoint-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    verbs:
    - create
    - delete
    - get
    - list
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints/restricted
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:generic-garbage-collector
  rules:
  - apiGroups:
    - '*'
    attributeRestrictions: null
    resources:
    - '*'
    verbs:
    - delete
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:horizontal-pod-autoscaler
  rules:
  - apiGroups:
    - autoscaling
    attributeRestrictions: null
    resources:
    - horizontalpodautoscalers
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - autoscaling
    attributeRestrictions: null
    resources:
    - horizontalpodautoscalers/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers/scale
    verbs:
    - get
    - update
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - replicationcontrollers/scale
    verbs:
    - get
    - update
  - apiGroups:
    - apps
    - extensions
    attributeRestrictions: null
    resources:
    - deployments/scale
    - replicasets/scale
    verbs:
    - get
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resourceNames:
    - 'http:heapster:'
    - 'https:heapster:'
    resources:
    - services
    verbs:
    - proxy
  - apiGroups:
    - ""
    attributeRestrictions: null
    resourceNames:
    - 'http:heapster:'
    - 'https:heapster:'
    resources:
    - services/proxy
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:job-controller
  rules:
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - jobs
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - batch
    attributeRestrictions: null
    resources:
    - jobs/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:namespace-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces
    verbs:
    - delete
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - namespaces/finalize
    - namespaces/status
    verbs:
    - update
  - apiGroups:
    - '*'
    attributeRestrictions: null
    resources:
    - '*'
    verbs:
    - delete
    - deletecollection
    - get
    - list
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:node-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - delete
    - get
    - list
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - delete
    - list
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:persistent-volume-binder
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumes
    verbs:
    - create
    - delete
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumes/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - apiGroups:
    - storage.k8s.io
    attributeRestrictions: null
    resources:
    - storageclasses
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - services
    verbs:
    - create
    - delete
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:pod-garbage-collector
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - delete
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - list
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:replicaset-controller
  rules:
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - replicasets
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - replicasets/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - list
    - patch
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:replication-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    verbs:
    - get
    - list
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - list
    - patch
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:resourcequota-controller
  rules:
  - apiGroups:
    - '*'
    attributeRestrictions: null
    resources:
    - '*'
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - resourcequotas/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:route-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/status
    verbs:
    - patch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:service-account-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - serviceaccounts
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:service-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - services/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:statefulset-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - statefulsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - statefulsets/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods
    verbs:
    - create
    - delete
    - get
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    verbs:
    - create
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:ttl-controller
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:certificate-controller
  rules:
  - apiGroups:
    - certificates.k8s.io
    attributeRestrictions: null
    resources:
    - certificatesigningrequests
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - certificates.k8s.io
    attributeRestrictions: null
    resources:
    - certificatesigningrequests/approval
    - certificatesigningrequests/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:basic-user
  rules:
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - selfsubjectaccessreviews
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:heapster
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    - namespaces
    - nodes
    - pods
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:node-problem-detector
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes/status
    verbs:
    - patch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:auth-delegator
  rules:
  - apiGroups:
    - authentication.k8s.io
    attributeRestrictions: null
    resources:
    - tokenreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    attributeRestrictions: null
    resources:
    - subjectaccessreviews
    verbs:
    - create
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:kube-aggregator
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - services
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:kube-controller-manager
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - secrets
    - serviceaccounts
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - secrets
    verbs:
    - delete
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - namespaces
    - serviceaccounts
    verbs:
    - get
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - serviceaccounts
    verbs:
    - update
  - apiGroups:
    - authentication.k8s.io
    attributeRestrictions: null
    resources:
    - tokenreviews
    verbs:
    - create
  - apiGroups:
    - '*'
    attributeRestrictions: null
    resources:
    - '*'
    verbs:
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:kube-scheduler
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - events
    verbs:
    - create
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resourceNames:
    - kube-scheduler
    resources:
    - endpoints
    verbs:
    - delete
    - get
    - patch
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - nodes
    - pods
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - bindings
    - pods/binding
    verbs:
    - create
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - pods/status
    verbs:
    - update
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - replicationcontrollers
    - services
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - extensions
    attributeRestrictions: null
    resources:
    - replicasets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    attributeRestrictions: null
    resources:
    - statefulsets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - persistentvolumeclaims
    - persistentvolumes
    verbs:
    - get
    - list
    - watch
- apiVersion: v1
  kind: ClusterRole
  metadata:
    annotations:
      authorization.openshift.io/system-only: "true"
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:kube-dns
  rules:
  - apiGroups:
    - ""
    attributeRestrictions: null
    resources:
    - endpoints
    - services
    verbs:
    - list
    - watch
kind: List
metadata: {}