apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kyverno:generate-cilium-cnps
  labels:
    kyverno.io/aggregate-to-background: "true"
    kyverno.io/aggregate-to-reports: "true"
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
rules:
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
    verbs:
      - create
      - update
      - patch
      - delete
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kyverno:generate-cilium-cnps-background-binding
subjects:
  - kind: ServiceAccount
    name: kyverno-background-controller
    namespace: kyverno
roleRef:
  kind: ClusterRole
  name: kyverno:generate-cilium-cnps
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kyverno:generate-cilium-cnps-admission-binding
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
subjects:
  - kind: ServiceAccount
    name: kyverno-admission-controller
    namespace: kyverno
roleRef:
  kind: ClusterRole
  name: kyverno:generate-cilium-cnps
  apiGroup: rbac.authorization.k8s.io