kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-pipelineloop-controller-cluster-access
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipeline-loops
rules:
    # Controller needs cluster access to all of the CRDs that it is responsible for managing.
  - apiGroups: ["tekton.dev"]
    resources: ["runs", "taskruns", "pipelineruns"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["runs/status", "taskruns/status", "pipelineruns/status", "runs/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["custom.tekton.dev"]
    resources: ["pipelineloops"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # This is the access that the controller needs on a per-namespace basis.
  name: tekton-pipelineloop-controller-tenant-access
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipeline-loops
rules:
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-pipelineloop-webhook-cluster-access
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipeline-loops
rules:
  # The webhook needs to be able to list and update customresourcedefinitions,
  # mainly to update the webhook certificates.
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions", "customresourcedefinitions/status"]
    verbs: ["get", "list", "update", "patch", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    # The webhook performs a reconciliation on these two resources and continuously
    # updates configuration.
    resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
    # knative starts informers on these things, which is why we need get, list and watch.
    verbs: ["list", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]
    # This mutating webhook is responsible for applying defaults to tekton objects
    # as they are received.
    resourceNames: ["webhook.pipelineloop.custom.tekton.dev"]
    # When there are changes to the configs or secrets, knative updates the mutatingwebhook config
    # with the updated certificates or the refreshed set of rules.
    verbs: ["get", "update"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
    # validation.webhook.pipelineloop.custom.tekton.dev performs schema validation when you, for example, create PipelineLoops.
    resourceNames: ["validation.webhook.pipelineloop.custom.tekton.dev"]
    # When there are changes to the configs or secrets, knative updates the validatingwebhook config
    # with the updated certificates or the refreshed set of rules.
    verbs: ["get", "update"]
  - apiGroups: ["policy"]
    resources: ["podsecuritypolicies"]
    resourceNames: ["tekton-pipelines"]
    verbs: ["use"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-pipelineloop-leader-election
  labels:
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipeline-loops
rules:
  # We uses leases for leaderelection
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]