apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "rise.fullname" . }}
  labels:
    {{- include "rise.labels" . | nindent 4 }}
  annotations:
    description: |
      ClusterRole for Rise backend when Kubernetes deployment is enabled.

      With Metacontroller, Rise only needs full permissions for RiseProject CRDs.
      Most resource management (namespaces, deployments, services, etc.) is handled
      by Metacontroller. Rise needs read-only access to pods for health checks and
      log streaming.
rules:
# RiseProject CRD management (create/delete/patch for lifecycle management)
- apiGroups: ["rise.dev"]
  resources: ["riseprojects"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Pod read access (for health checks in sync webhook and log streaming)
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

# Pod logs (for log streaming endpoint)
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get"]

# Events (for monitoring pod errors in sync webhook)
- apiGroups: [""]
  resources: ["events"]
  verbs: ["get", "list", "watch"]

# Endpoints (for backend service routing, applied directly via kube-rs)
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get", "patch"]
