apiVersion: v1
kind: Namespace
metadata:
  name: portworx
---
kind: Role
apiVersion: {{ template "rbac.apiVersion" . }}
metadata:
  name: px-role
  namespace: portworx
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: {{ template "rbac.apiVersion" . }}
metadata:
  name: px-role-binding
  namespace: portworx
subjects:
  - kind: ServiceAccount
    name: px-account
    namespace: kube-system
roleRef:
  kind: Role
  name: px-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: px-account
  namespace: kube-system
---
kind: ClusterRole
apiVersion: {{ template "rbac.apiVersion" . }}
metadata:
   name: node-get-put-list-role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["watch", "get", "update", "list"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["delete", "get", "list", "watch", "update"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims", "persistentvolumes"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "update", "create"]
- apiGroups: ["extensions"]
  resources: ["podsecuritypolicies"]
  resourceNames: ["privileged"]
  verbs: ["use"]
- apiGroups: ["portworx.io"]
  resources: ["volumeplacementstrategies"]
  verbs: ["get", "list"]
- apiGroups: ["stork.libopenstorage.org"]
  resources: ["backuplocations"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create"]
---

kind: ClusterRoleBinding
apiVersion: {{ template "rbac.apiVersion" . }}
metadata:
  name: node-role-binding
subjects:
- kind: ServiceAccount
  name: px-account
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: node-get-put-list-role
  apiGroup: rbac.authorization.k8s.io
