apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jump-crossplane-readonly
  labels:
    jump-service.devops.cloud.pingcap.com/aggregate-to-jump-gateway-readonly: "true"
rules:
# Crossplane project APIs (not cloud-specific)
- apiGroups:
  - apiextensions.crossplane.io
  - pkg.crossplane.io
  - secrets.crossplane.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
# Alibaba Cloud (Upbound provider-family CRDs)
- apiGroups:
  - ack.alibabacloud.crossplane.io
  - ackone.alibabacloud.crossplane.io
  - alb.alibabacloud.crossplane.io
  - alibabacloud.crossplane.io
  - alidns.alibabacloud.crossplane.io
  - cdn.alibabacloud.crossplane.io
  - cloudmonitorservice.alibabacloud.crossplane.io
  - ecs.alibabacloud.crossplane.io
  - eip.alibabacloud.crossplane.io
  - fcv3.alibabacloud.crossplane.io
  - kms.alibabacloud.crossplane.io
  - messageservice.alibabacloud.crossplane.io
  - natgateway.alibabacloud.crossplane.io
  - oss.alibabacloud.crossplane.io
  - polardb.alibabacloud.crossplane.io
  - privatelink.alibabacloud.crossplane.io
  - pvtz.alibabacloud.crossplane.io
  - quotas.alibabacloud.crossplane.io
  - ram.alibabacloud.crossplane.io
  - slb.alibabacloud.crossplane.io
  - tair.alibabacloud.crossplane.io
  - vpc.alibabacloud.crossplane.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
# AWS (Upbound provider-family CRDs)
- apiGroups:
  - aws.upbound.io
  - ec2.aws.upbound.io
  - eks.aws.upbound.io
  - iam.aws.upbound.io
  - route53.aws.upbound.io
  - s3.aws.upbound.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
# Azure (Upbound provider-family CRDs)
- apiGroups:
  - authorization.azure.upbound.io
  - azure.upbound.io
  - compute.azure.upbound.io
  - containerservice.azure.upbound.io
  - managedidentity.azure.upbound.io
  - network.azure.upbound.io
  - storage.azure.upbound.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
# GCP (Upbound provider-family CRDs)
- apiGroups:
  - compute.gcp.upbound.io
  - container.gcp.upbound.io
  - dns.gcp.upbound.io
  - gcp.upbound.io
  - iam.gcp.upbound.io
  - storage.gcp.upbound.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - aws.crossplane.io
  - eks.aws.crossplane.io
  - ec2.aws.crossplane.io
  - route53.aws.crossplane.io
  - kms.aws.crossplane.io
  - iam.aws.crossplane.io
  - autoscaling.aws.crossplane.io
  - lambda.aws.crossplane.io
  - s3.aws.crossplane.io
  - gcp.crossplane.io
  - compute.gcp.crossplane.io
  - container.gcp.crossplane.io
  - dns.gcp.crossplane.io
  - iam.gcp.crossplane.io
  - kms.gcp.crossplane.io
  - pubsub.gcp.crossplane.io
  - storage.gcp.crossplane.io
  - vpcpeering.gcp.crossplane.io
  - vpcpeerconnection.alibabacloud.crossplane.io
  resources:
  - "*"
  verbs:
  - get
  - list
  - watch