apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dex
  labels:
    helm.sh/chart: {{ include "deploykf-auth.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: dex
rules:
  ## dex needs these permissions when its `storage.type = kubernetes`
  - apiGroups:
      - dex.coreos.com
    resources:
     - "*"
    verbs:
     - "*"
  - apiGroups:
     - apiextensions.k8s.io
    resources:
     - customresourcedefinitions
    verbs:
     - create
