---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ticdc-service-role
  labels:
    app: ticdc-service
rules:
- apiGroups:
  - cdc.tidbcloud.com
  resources:
  - sinkendpoints
  - ticdcs
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - cdc.tidbcloud.com
  resources:
  - sinkendpoints/finalizers
  - ticdcs/finalizers
  verbs:
  - update
- apiGroups:
  - cdc.tidbcloud.com
  resources:
  - sinkendpoints/status
  - ticdcs/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - azure.upbound.io
  - containerservice.azure.upbound.io
  - network.azure.upbound.io
  - aws.upbound.io
  - eks.aws.upbound.io
  - ec2.aws.upbound.io
  - route53.aws.upbound.io
  - gcp.upbound.io
  - container.gcp.upbound.io
  - compute.gcp.upbound.io
  - dns.gcp.upbound.io
  resources:
    - "*"
  verbs:
    - "*"
- apiGroups:
  - ""
  resources:
    - events
  verbs:
    - create
    - patch
- apiGroups:
  - cloud.pingcap.com
  resources:
    - clusters
  verbs:
    - get
    - list
- apiGroups:
    - coordination.k8s.io
  resources:
    - leases
  verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete