apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gcp-provider-cluster-role
rules:
- apiGroups:
  - gcp.crossplane.io
  - compute.gcp.crossplane.io
  - iam.gcp.crossplane.io
  - storage.gcp.crossplane.io
  - bucketpolicy.storage.gcp.crossplane.io
  - bucketpolicymember.storage.gcp.crossplane.io
  - vpcpeering.gcp.crossplane.io
  - dns.gcp.crossplane.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  - configmaps/status
  - events
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gcp-provider-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gcp-provider-cluster-role
subjects:
- kind: ServiceAccount
  name: gcp-provider
  namespace: cluster-service
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gcp-provider
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gcp-provider-upstream-cluster-role
rules:
- apiGroups:
  - gcp.crossplane.io
  - dns.gcp.crossplane.io
  - cache.gcp.crossplane.io
  - cloudmemorystoreinstance.cache.gcp.crossplane.io
  - database.gcp.crossplane.io
  - cloudsqlinstance.database.gcp.crossplane.io
  - compute.gcp.crossplane.io
  - firewall.compute.gcp.crossplane.io
  - router.compute.gcp.crossplane.io
  - address.compute.gcp.crossplane.io
  - globaladdress.compute.gcp.crossplane.io
  - network.compute.gcp.crossplane.io
  - subnetwork.compute.gcp.crossplane.io
  - container.gcp.crossplane.io
  - nodepool.container.gcp.crossplane.io
  - cluster.container.gcp.crossplane.io
  - iam.gcp.crossplane.io
  - serviceaccount.iam.gcp.crossplane.io
  - serviceaccountkey.iam.gcp.crossplane.io
  - serviceaccountpolicy.iam.gcp.crossplane.io
  - kms.gcp.crossplane.io
  - cryptokey.kms.gcp.crossplane.io
  - cryptokeypolicy.kms.gcp.crossplane.io
  - keyring.kms.gcp.crossplane.io
  - pubsub.gcp.crossplane.io
  - topic.pubsub.gcp.crossplane.io
  - subscription.pubsub.gcp.crossplane.io
  - registry.gcp.crossplane.io
  - containerregistry.registry.gcp.crossplane.io
  - servicenetworking.gcp.crossplane.io
  - connection.servicenetworking.gcp.crossplane.io
  - storage.gcp.crossplane.io
  - bucket.storage.gcp.crossplane.io
  - bucketpolicy.storage.gcp.crossplane.io
  - bucketpolicymember.storage.gcp.crossplane.io
  - gcp.upbound.io
  - container.gcp.upbound.io
  - compute.gcp.upbound.io
  - dns.gcp.upbound.io
  - iam.gcp.upbound.io
  - storage.gcp.upbound.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  - configmaps/status
  - events
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gcp-provider-upstream-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gcp-provider-upstream-cluster-role
subjects:
- kind: ServiceAccount
  name: gcp-ups
  namespace: cluster-service
- kind: ServiceAccount
  name: gcp-provider
  namespace: crossplane-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  # The workload identity uses cluster-service/gcp-ups sa
  # gcloud iam service-accounts get-iam-policy crossplane-gcp-ups@pingcap-gardener.iam.gserviceaccount.com
  # To change to another k8s sa, we need to update the above policy
  name: gcp-ups