kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-pipelines-controller-cluster-access
  labels:
    app.kubernetes.io/component: tekton-pipelines-controller
rules:
  - apiGroups: [""]
    # Namespace access is required because the controller timeout handling logic
    # iterates over all namespaces and times out any PipelineRuns that have expired.
    # Pod access is required because the taskrun controller wants to be updated when
    # a Pod underlying a TaskRun changes state.
    resources: ["namespaces", "pods"]
    verbs: ["list", "watch"]
    # Controller needs cluster access to all of the CRDs that it is responsible for
    # managing.
  - apiGroups: ["tekton.dev"]
    resources: ["tasks", "clustertasks", "taskruns", "pipelines", "pipelineruns", "pipelineresources", "conditions", "runs"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["taskruns/finalizers", "pipelineruns/finalizers", "runs/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["tasks/status", "clustertasks/status", "taskruns/status", "pipelines/status", "pipelineruns/status", "pipelineresources/status", "runs/status"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # This is the access that the controller needs on a per-namespace basis.
  name: tekton-pipelines-controller-tenant-access
  labels:
    app.kubernetes.io/component: tekton-pipelines-controller
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log", "secrets", "events", "serviceaccounts", "configmaps", "persistentvolumeclaims", "limitranges"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
    # Unclear if this access is actually required.  Simply a hold-over from the previous
    # incarnation of the controller's ClusterRole.
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-pipelines-webhook-cluster-access
  labels:
    app.kubernetes.io/component: tekton-pipelines-webhook
rules:
  # The webhook needs to be able to list and update customresourcedefinitions,
  # mainly to update the webhook certificates.
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions", "customresourcedefinitions/status"]
    verbs: ["get", "list", "update", "patch", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    # The webhook performs a reconciliation on these two resources and continuously
    # updates configuration.
    resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
    # knative starts informers on these things, which is why we need get, list and watch.
    verbs: ["list", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]
    # This mutating webhook is responsible for applying defaults to tekton objects
    # as they are received.
    resourceNames: ["webhook.pipeline.tekton.dev"]
    # When there are changes to the configs or secrets, knative updates the mutatingwebhook config
    # with the updated certificates or the refreshed set of rules.
    verbs: ["get", "update"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
    # validation.webhook.pipeline.tekton.dev performs schema validation when you, for example, create TaskRuns.
    # config.webhook.pipeline.tekton.dev validates the logging configuration against knative's logging structure
    resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"]
    # When there are changes to the configs or secrets, knative updates the validatingwebhook config
    # with the updated certificates or the refreshed set of rules.
    verbs: ["get", "update"]
  - apiGroups: ["policy"]
    resources: ["podsecuritypolicies"]
    resourceNames: ["tekton-pipelines"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-aggregate-edit
  labels:
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
  - apiGroups:
      - tekton.dev
    resources:
      - tasks
      - taskruns
      - pipelines
      - pipelineruns
      - pipelineresources
      - conditions
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-aggregate-view
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
  - apiGroups:
      - tekton.dev
    resources:
      - tasks
      - taskruns
      - pipelines
      - pipelineruns
      - pipelineresources
      - conditions
    verbs:
      - get
      - list
      - watch