apiVersion: v1
kind: Template
metadata:
  name: service-catalog-role-bindings
objects:

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: servicecatalog-serviceclass-viewer
  rules:
  - apiGroups:
    - servicecatalog.k8s.io
    resources:
    - clusterserviceclasses
    - clusterserviceplans
    verbs:
    - list
    - watch
    - get

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: servicecatalog-serviceclass-viewer-binding
  roleRef:
    kind: ClusterRole
    name: servicecatalog-serviceclass-viewer
  subjects:
  - kind: Group
    name: system:authenticated

- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: service-catalog-controller

- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: service-catalog-apiserver

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: sar-creator
  rules:
  - apiGroups:
    - ""
    resources:
    - subjectaccessreviews.authorization.k8s.io
    verbs:
    - create

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: service-catalog-sar-creator-binding
  roleRef:
    kind: ClusterRole
    name: sar-creator
  subjects:
  - kind: ServiceAccount
    name: service-catalog-apiserver
    namespace: kube-service-catalog

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: namespace-viewer
  rules:
  - apiGroups:
    - ""
    resources:
    - namespaces
    verbs:
    - list
    - watch
    - get
  - apiGroups:
    - "admissionregistration.k8s.io"
    resources:
    - validatingwebhookconfigurations
    - mutatingwebhookconfigurations
    verbs:
    - list
    - watch
    - get

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: service-catalog-namespace-viewer-binding
  roleRef:
    kind: ClusterRole
    name: namespace-viewer
  subjects:
  - kind: ServiceAccount
    name: service-catalog-apiserver
    namespace: kube-service-catalog

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: service-catalog-controller-namespace-viewer-binding
  roleRef:
    kind: ClusterRole
    name: namespace-viewer
  subjects:
  - kind: ServiceAccount
    name: service-catalog-controller
    namespace: kube-service-catalog

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: service-catalog-controller
  rules:
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - create
    - update
    - patch
    - delete
    - get
    - list
    - watch
  - apiGroups:
    - servicecatalog.k8s.io
    resources:
    - clusterservicebrokers/status
    - clusterserviceclasses/status
    - clusterserviceplans/status
    - serviceinstances/status
    - servicebindings/status
    - servicebindings/finalizers
    - serviceinstances/reference
    - servicebrokers/status
    - serviceclasses/status
    - serviceplans/status
    verbs:
    - update
  - apiGroups:
    - servicecatalog.k8s.io
    resources:
    - clusterservicebrokers
    - serviceinstances
    - servicebindings
    - servicebrokers
    verbs:
    - list
    - get
    - watch
  - apiGroups:
    - ""
    resources:
    - events
    verbs:
    - patch
    - create
  - apiGroups:
    - servicecatalog.k8s.io
    resources:
    - clusterserviceclasses
    - clusterserviceplans
    - serviceclasses
    - serviceplans
    verbs:
    - create
    - delete
    - update
    - patch
    - get
    - list
    - watch
  - apiGroups:
    - settings.k8s.io
    resources:
    - podpresets
    verbs:
    - create
    - update
    - delete
    - get
    - list
    - watch

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: service-catalog-controller-binding
  roleRef:
    kind: ClusterRole
    name: service-catalog-controller
  subjects:
  - kind: ServiceAccount
    name: service-catalog-controller
    namespace: kube-service-catalog

- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: configmap-accessor
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - list
    - watch
    - get
    - create
    - update

- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: configmap-accessor-binding
    namespace: kube-service-catalog
  roleRef:
    kind: Role
    name: configmap-accessor
  subjects:
  - kind: ServiceAccount
    namespace: kube-service-catalog
    name: service-catalog-controller

- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: cluster-info-configmap
    namespace: kube-service-catalog
  rules:
  - apiGroups:     [""]
    resources:     ["configmaps"]
    resourceNames: ["cluster-info"]
    verbs:         ["get","create","list","watch","update"]

- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: cluster-info-configmap-binding
    namespace: kube-service-catalog
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: cluster-info-configmap
  subjects:
  - kind: ServiceAccount
    namespace: kube-service-catalog
    name: service-catalog-controller

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: system:auth-delegator-binding
  roleRef:
    kind: ClusterRole
    name: system:auth-delegator
  subjects:
  - kind: ServiceAccount
    name: service-catalog-apiserver
    namespace: kube-service-catalog

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: servicecatalog.k8s.io:service-catalog-readiness
  rules:
  - nonResourceURLs:
    - /healthz/ready
    verbs:
      - get

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: servicecatalog.k8s.io:service-catalog-readiness
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: servicecatalog.k8s.io:service-catalog-readiness
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:unauthenticated
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:authenticated
