
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    kots.io/backup: velero
    kots.io/kotsadm: "true"
  name: kotsadm

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    kots.io/backup: velero
    kots.io/kotsadm: "true"
  name: kotsadm-role
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["update"]
    resourceNames:
      - replicated
      - replicated-instance-report
      - replicated-custom-app-metrics-report
      - replicated-meta-data
  - apiGroups: [""]
    resources:
      - configmaps
      - endpoints
      - endpoints/restricted
      - events
      - namespaces
      - persistentvolumeclaims
      - pods
      - pods/exec
      - pods/log
      - resourcequotas
      - secrets
      - serviceaccounts
      - services
      - limitranges
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["apps", "batch", "networking.k8s.io", "extensions", "policy", "cert-manager.io", "itrsgroup.com"]
    resources:
      - daemonsets
      - daemonsets/scale
      - deployments
      - deployments/scale
      - replicasets
      - statefulsets
      - statefulsets/scale
      - jobs
      - jobs/status
      - cronjobs
      - ingresses
      - poddisruptionbudgets
      - issuers
      - certificates
      - obcervs
      - obcervs/status
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings"]
    verbs: ["get", "create", "update", "patch", "delete"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["selfsubjectaccessreviews", "selfsubjectrulesreviews"]
    verbs: ["create"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list"]
  - apiGroups: ["events.k8s.io"]
    resources: ["events"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots"]
    verbs: ["get", "list", "patch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    kots.io/backup: velero
    kots.io/kotsadm: "true"
  name: kotsadm-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kotsadm-role
subjects:
  - kind: ServiceAccount
    name: kotsadm

