####################################################################
##### The portion below this marker is automatically generated #####
#####                    DO NOT EDIT BY HAND                   #####
####################################################################

clusterScopedKinds:
  - apiGroup: ""
    resources:
      - configmaps/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: ""
    resources:
      - persistentvolumeclaims/finalizers
    verbs:
      - create
      - update
      - delete
      - get
    systemResources: []
  - apiGroup: extensions
    resources:
      - ingresses
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
    systemResources: []
  - apiGroup: argoproj.io
    resources:
      - eventsources
      - sensors
    verbs:
      - "*"
    systemResources: []
  - apiGroup: route.openshift.io
    resources:
      - "*"
    verbs:
      - "*"
    systemResources: []
  - apiGroup: nvidia.com
    kind: ClusterPolicy
    resources:
      - clusterpolicies
      - clusterpolicies/status
    verbs:
      - "*"
    systemResources:
      - cluster-policy
  - apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    resources:
      - clusterroles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - bind
      # - escalate
    systemResources:
      - acn-multitenancy-editor
      - admin
      - aks-secretproviderclasses-admin-role
      - aks-secretproviderclasses-role
      - aks-secretproviderclasses-viewer-role
      - aks-secretprovidersyncing-role
      - aks-secretprovidertokenrequest-role
      - aks-service
      - ama-logs-reader
      - appmonitoringconfig-user
      - argocd-application-controller
      - argocd-notifications-controller
      - argocd-server
      - assets-sync
      - assets-sync-cluster
      - azure-wi-webhook-manager-role
      - cert-manager-cainjector
      - cert-manager-cluster-view
      - cert-manager-controller-approve:cert-manager-io
      - cert-manager-controller-certificates
      - cert-manager-controller-certificatesigningrequests
      - cert-manager-controller-challenges
      - cert-manager-controller-clusterissuers
      - cert-manager-controller-ingress-shim
      - cert-manager-controller-issuers
      - cert-manager-controller-orders
      - cert-manager-edit
      - cert-manager-view
      - cert-manager-webhook:subjectaccessreviews
      - cilium
      - cilium-operator
      - cloud-node-manager
      - cluster-admin
      - cluster-sync
      - cluster-sync-project
      - container-health-log-reader
      - csi-azuredisk-node-role
      - csi-azurefile-node-secret-role
      - dgxc-admission-controller
      - dgxc-customer-app-admin
      - dgxc-customer-app-admin-base
      - dgxc-customer-network-policy
      - dgxc-exporter
      - dgxc-logging-alloy
      - dgxc-runai-controller
      - edit
      - gpu-operator
      - gpu-operator-node-feature-discovery
      - gpu-operator-node-feature-discovery-gc
      - ingress-nginx
      - knative-serving-activator-cluster
      - knative-serving-addressable-resolver
      - knative-serving-admin
      - knative-serving-aggregated-addressable-resolver
      - knative-serving-core
      - knative-serving-namespaced-admin
      - knative-serving-namespaced-edit
      - knative-serving-namespaced-view
      - knative-serving-podspecable-binding
      - kratos-fluent-bit-read
      - kube-oidc-proxy
      - kubeflow-mpijobs-admin
      - kubeflow-mpijobs-edit
      - kubeflow-mpijobs-view
      - kyverno-cleanup-jobs
      - kyverno:admission-controller
      - kyverno:admission-controller:additional
      - kyverno:admission-controller:core
      - kyverno:background-controller
      - kyverno:background-controller:additional
      - kyverno:background-controller:core
      - kyverno:cleanup-controller
      - kyverno:cleanup-controller:core
      - kyverno:dgxc-integrations
      - kyverno:rbac:admin:policies
      - kyverno:rbac:admin:policyreports
      - kyverno:rbac:admin:reports
      - kyverno:rbac:admin:updaterequests
      - kyverno:rbac:view:policies
      - kyverno:rbac:view:policyreports
      - kyverno:rbac:view:reports
      - kyverno:rbac:view:updaterequests
      - kyverno:reports-controller
      - kyverno:reports-controller:core
      - kyverno:watch-update-namespaces
      - kyverno:watch-update-services
      - metrics-exporter
      - mpi-operator
      - net-kourier
      - network-operator
      - node-scale-adjuster-ro
      - nodepool-controller
      - nv-ipam-controller
      - nv-ipam-node
      - nvidia-device-plugin
      - nvidia-device-plugin-mps-control-daemon
      - nvidia-driver
      - nvidia-gpu-feature-discovery
      - nvidia-mig-manager
      - nvidia-operator-validator
      - ofed-driver
      - pod-group-assigner
      - pod-group-controller
      - pod-group-controller-ro
      - pod-grouper
      - pod-reader-all-namespaces
      - prometheus-kube-state-metrics
      - prometheus-operator
      - prometheus-prometheus
      - queue-controller
      - researcher-service-ro
      - researcher-service-rw
      - runai-accessrule-controller
      - runai-accessrule-controller-project
      - runai-admission-controller-project
      - runai-admission-controller-ro
      - runai-agent
      - runai-agent-project
      - runai-binder-cluster-wide
      - runai-binder-project
      - runai-cluster-api
      - runai-cluster-api-project
      - runai-compute-resource-administrator
      - runai-compute-resource-administrator-ns
      - runai-compute-resource-administrator-runai
      - runai-credentials-administrator
      - runai-credentials-administrator-ns
      - runai-credentials-administrator-runai
      - runai-data-source-administrator
      - runai-data-source-administrator-ns
      - runai-data-source-administrator-runai
      - runai-data-source-administrator-runai-cs
      - runai-data-volume-administrator
      - runai-data-volume-administrator-ns
      - runai-data-volume-administrator-runai
      - runai-department-administrator
      - runai-department-administrator-ns
      - runai-department-administrator-runai
      - runai-department-viewer
      - runai-department-viewer-ns
      - runai-department-viewer-runai
      - runai-device-plugin
      - runai-editor
      - runai-editor-ns
      - runai-editor-runai
      - runai-engine-operator
      - runai-environment-administrator
      - runai-environment-administrator-ns
      - runai-environment-administrator-runai
      - runai-external-workload-integrator
      - runai-external-workload-integrator-project
      - runai-inference-workload-controller
      - runai-inference-workload-controller-project
      - runai-init-ca
      - runai-job-controller
      - runai-job-controller-project
      - runai-l1-researcher
      - runai-l1-researcher-ns
      - runai-l1-researcher-runai
      - runai-l2-researcher
      - runai-l2-researcher-ns
      - runai-l2-researcher-runai
      - runai-ml-engineer
      - runai-ml-engineer-ns
      - runai-ml-engineer-runai
      - runai-node-exporter-role
      - runai-operator
      - runai-project-controller
      - runai-project-controller-cluster-configmap-per-project
      - runai-project-controller-cluster-pvc
      - runai-project-controller-cluster-pvc-per-project
      - runai-project-controller-cluster-secret
      - runai-project-controller-cluster-secret-per-project
      - runai-project-controller-limit-range
      - runai-project-controller-limit-range-per-project
      - runai-project-controller-ns-creation
      - runai-project-controller-resources-patcher
      - runai-project-controller-rolebinding-creation
      - runai-project-controller-servicemonitor-creation
      - runai-prometheus
      - runai-research-manager
      - runai-research-manager-ns
      - runai-research-manager-runai
      - runai-resource-reservation-rw
      - runai-scheduler-ro
      - runai-scheduler-rw
      - runai-shared-objects-controller
      - runai-shared-objects-controller-project
      - runai-system-administrator
      - runai-system-administrator-ns
      - runai-system-administrator-runai
      - runai-system-administrator-runai-cs
      - runai-template-administrator
      - runai-template-administrator-ns
      - runai-template-administrator-runai
      - runai-viewer
      - runai-viewer-ns
      - runai-viewer-runai
      - runai-workload-exporter
      - secretproviderrotation-role
      - skyhook-operator-manager-role
      - skyhook-operator-metrics-reader
      - skyhook-operator-proxy-role
      - sre-cluster-scoped-access
      - status-updater
      - status-updater-ro
      - system:aggregate-to-admin
      - system:aggregate-to-edit
      - system:aggregate-to-view
      - system:auth-delegator
      - system:azure-cloud-provider
      - system:azure-cloud-provider-secret-getter
      - system:basic-user
      - system:certificates.k8s.io:certificatesigningrequests:nodeclient
      - system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
      - system:certificates.k8s.io:kube-apiserver-client-approver
      - system:certificates.k8s.io:kube-apiserver-client-kubelet-approver
      - system:certificates.k8s.io:kubelet-serving-approver
      - system:certificates.k8s.io:legacy-unknown-approver
      - system:controller:attachdetach-controller
      - system:controller:certificate-controller
      - system:controller:clusterrole-aggregation-controller
      - system:controller:cronjob-controller
      - system:controller:daemon-set-controller
      - system:controller:deployment-controller
      - system:controller:disruption-controller
      - system:controller:endpoint-controller
      - system:controller:endpointslice-controller
      - system:controller:endpointslicemirroring-controller
      - system:controller:ephemeral-volume-controller
      - system:controller:expand-controller
      - system:controller:generic-garbage-collector
      - system:controller:horizontal-pod-autoscaler
      - system:controller:job-controller
      - system:controller:legacy-service-account-token-cleaner
      - system:controller:namespace-controller
      - system:controller:node-controller
      - system:controller:persistent-volume-binder
      - system:controller:pod-garbage-collector
      - system:controller:pv-protection-controller
      - system:controller:pvc-protection-controller
      - system:controller:replicaset-controller
      - system:controller:replication-controller
      - system:controller:resourcequota-controller
      - system:controller:root-ca-cert-publisher
      - system:controller:route-controller
      - system:controller:service-account-controller
      - system:controller:service-controller
      - system:controller:statefulset-controller
      - system:controller:ttl-after-finished-controller
      - system:controller:ttl-controller
      - system:coredns
      - system:coredns-autoscaler
      - system:discovery
      - system:heapster
      - system:kube-aggregator
      - system:kube-controller-manager
      - system:kube-dns
      - system:kube-scheduler
      - system:kubelet-api-admin
      - system:metrics-server
      - system:monitoring
      - system:node
      - system:node-bootstrapper
      - system:node-problem-detector
      - system:node-proxier
      - system:persistent-volume-provisioner
      - system:persistent-volume-secret-operator
      - system:prometheus
      - system:public-info-viewer
      - system:service-account-issuer-discovery
      - system:volume-scheduler
      - training-operator
      - vace-role
      - view
      - workload-controller-ro
      - workload-controller-rw
      - workload-overseer
  - apiGroup: rbac.authorization.k8s.io
    kind: ClusterRoleBinding
    resources:
      - clusterrolebindings
    verbs:
      - "*"
    systemResources:
      - acn-multitenancy-editor-binding
      - aks-cluster-admin-binding
      - aks-cluster-admin-binding-aad
      - aks-secretproviderclasses-rolebinding
      - aks-secretprovidersyncing-rolebinding
      - aks-secretprovidertokenrequest-rolebinding
      - aks-service-rolebinding
      - amalogsclusterrolebinding
      - appmonitoringconfig-user-global
      - argocd-application-controller
      - argocd-notifications-controller
      - argocd-server
      - assets-sync
      - auto-approve-csrs-for-group
      - auto-approve-renewals-for-nodes
      - azure-wi-webhook-manager-rolebinding
      - billing-admin-binding
      - cert-manager-cainjector
      - cert-manager-controller-approve:cert-manager-io
      - cert-manager-controller-certificates
      - cert-manager-controller-certificatesigningrequests
      - cert-manager-controller-challenges
      - cert-manager-controller-clusterissuers
      - cert-manager-controller-ingress-shim
      - cert-manager-controller-issuers
      - cert-manager-controller-orders
      - cert-manager-webhook:subjectaccessreviews
      - cilium
      - cilium-operator
      - cloud-node-manager
      - cluster-admin
      - cluster-sync
      - container-health-read-logs-global
      - create-csrs-for-bootstrapping
      - csi-azuredisk-node-binding
      - csi-azurefile-node-secret-binding
      - dgxc-admission-controller
      - dgxc-customer-app-admin
      # - dgxc-customer-app-admin-access
      - dgxc-exporter
      - dgxc-logging-alloy
      - dgxc-runai-controller
      - extension-operator
      - gpu-operator
      - gpu-operator-node-feature-discovery
      - gpu-operator-node-feature-discovery-gc
      - ingress-nginx
      - knative-serving-activator-cluster
      - knative-serving-controller-addressable-resolver
      - knative-serving-controller-admin
      - kratos-fluent-bit-read
      - kube-oidc-proxy
      - kyverno-cleanup-jobs
      - kyverno:admission-controller
      - kyverno:background-controller
      - kyverno:cleanup-controller
      - kyverno:reports-controller
      - metrics-exporter
      - metrics-server:system:auth-delegator
      - mpi-operator
      - net-kourier
      - network-operator
      - node-scale-adjuster-ro
      - nodepool-controller
      - nv-ipam-controller
      - nv-ipam-node
      - nvidia-device-plugin
      - nvidia-device-plugin-mps-control-daemon
      - nvidia-driver
      - nvidia-gpu-feature-discovery
      - nvidia-mig-manager
      - nvidia-operator-validator
      - ofed-driver
      - pod-group-assigner
      - pod-group-controller-ro
      - pod-grouper
      - pod-reader-all-namespaces-binding
      - prometheus-kube-state-metrics
      - prometheus-operator
      - prometheus-prometheus
      - queue-controller
      - researcher-service-ro
      - runai-accessrule-controller
      - runai-admission-controller-ro
      - runai-agent
      - runai-binder-cluster-wide
      - runai-cluster-api
      - runai-compute-resource-administrator
      - runai-credentials-administrator
      - runai-data-source-administrator
      - runai-data-volume-administrator
      - runai-department-administrator
      - runai-department-viewer
      - runai-device-plugin
      - runai-editor
      - runai-engine-operator
      - runai-environment-administrator
      - runai-external-workload-integrator
      - runai-inference-workload-controller
      - runai-init-ca
      - runai-job-controller
      - runai-l1-researcher
      - runai-l2-researcher
      - runai-ml-engineer
      - runai-node-exporter-role
      - runai-operator
      - runai-project-controller
      - runai-project-controller-cluster-pvc
      - runai-project-controller-cluster-secret
      - runai-project-controller-limit-range
      - runai-project-controller-ns-creation
      - runai-project-controller-rolebinding-creation
      - runai-project-controller-servicemonitor-creation
      - runai-prometheus
      - runai-research-manager
      - runai-scheduler-ro
      - runai-shared-objects-controller
      - runai-system-administrator
      - runai-template-administrator
      - runai-viewer
      - runai-workload-exporter
      - secretproviderrotation-rolebinding
      - skyhook-operator-manager-rolebinding
      - skyhook-operator-proxy-rolebinding
      - sre-cluster-scoped-access
      - sre-full-access-binding
      - status-updater-ro
      - system:aks-client-node-proxier
      - system:azure-cloud-provider
      - system:azure-cloud-provider-secret-getter
      - system:basic-user
      - system:controller:attachdetach-controller
      - system:controller:certificate-controller
      - system:controller:clusterrole-aggregation-controller
      - system:controller:cronjob-controller
      - system:controller:daemon-set-controller
      - system:controller:deployment-controller
      - system:controller:disruption-controller
      - system:controller:endpoint-controller
      - system:controller:endpointslice-controller
      - system:controller:endpointslicemirroring-controller
      - system:controller:ephemeral-volume-controller
      - system:controller:expand-controller
      - system:controller:generic-garbage-collector
      - system:controller:horizontal-pod-autoscaler
      - system:controller:job-controller
      - system:controller:legacy-service-account-token-cleaner
      - system:controller:namespace-controller
      - system:controller:node-controller
      - system:controller:persistent-volume-binder
      - system:controller:pod-garbage-collector
      - system:controller:pv-protection-controller
      - system:controller:pvc-protection-controller
      - system:controller:replicaset-controller
      - system:controller:replication-controller
      - system:controller:resourcequota-controller
      - system:controller:root-ca-cert-publisher
      - system:controller:route-controller
      - system:controller:service-account-controller
      - system:controller:service-controller
      - system:controller:statefulset-controller
      - system:controller:ttl-after-finished-controller
      - system:controller:ttl-controller
      - system:coredns
      - system:coredns-autoscaler
      - system:discovery
      - system:kube-controller-manager
      - system:kube-dns
      - system:kube-scheduler
      - system:metrics-server
      - system:monitoring
      - system:node
      - system:node-proxier
      - system:persistent-volume-binding
      - system:prometheus
      - system:public-info-viewer
      - system:service-account-issuer-discovery
      - system:volume-scheduler
      - training-operator
      - vace-rolebinding
      - workload-controller-ro
      - workload-overseer
  - apiGroup: ""
    kind: ComponentStatus
    resources:
      - componentstatuses
    verbs:
      - "*"
    systemResources:
      - controller-manager
      - scheduler
      - etcd-1
      - etcd-0
  - apiGroup: apiextensions.k8s.io
    kind: CustomResourceDefinition
    resources:
      - customresourcedefinitions
      - customresourcedefinitions/status
    verbs:
      - "*"
    systemResources:
      - accessrules.run.ai
      - admissionreports.kyverno.io
      - alertmanagerconfigs.monitoring.coreos.com
      - alertmanagers.monitoring.coreos.com
      - applications.argoproj.io
      - applicationsets.argoproj.io
      - appprojects.argoproj.io
      - backgroundscanreports.kyverno.io
      - billingerrors.clusterconfig.azure.com
      - billingsettingses.clusterconfig.azure.com
      - billingstorages.clusterconfig.azure.com
      - billingusages.clusterconfig.azure.com
      - bindrequests.scheduling.run.ai
      - blockdeviceclaims.openebs.io
      - blockdevices.openebs.io
      - capacityprovisionerconfigs.containerstorage.azure.com
      - certificaterequests.cert-manager.io
      - certificates.cert-manager.io
      - certificates.networking.internal.knative.dev
      - challenges.acme.cert-manager.io
      - cidrpools.nv-ipam.nvidia.com
      - ciliumcidrgroups.cilium.io
      - ciliumclusterwidenetworkpolicies.cilium.io
      - ciliumendpoints.cilium.io
      - ciliumexternalworkloads.cilium.io
      - ciliumidentities.cilium.io
      - ciliuml2announcementpolicies.cilium.io
      - ciliumloadbalancerippools.cilium.io
      - ciliumnetworkpolicies.cilium.io
      - ciliumnodeconfigs.cilium.io
      - ciliumnodes.cilium.io
      - ciliumpodippools.cilium.io
      - cleanuppolicies.kyverno.io
      - clusteradmissionreports.kyverno.io
      - clusterbackgroundscanreports.kyverno.io
      - clustercleanuppolicies.kyverno.io
      - clusterdomainclaims.networking.internal.knative.dev
      - clusterissuers.cert-manager.io
      - clusterpolicies.kyverno.io
      - clusterpolicies.nvidia.com
      - clusterpolicyreports.wgpolicyk8s.io
      - configs.engine.run.ai
      - configsyncstatuses.clusterconfig.azure.com
      - configurations.serving.knative.dev
      - datavolumes.run.ai
      - departments.scheduling.run.ai
      - diskpools.containerstorage.azure.com
      - diskpools.openebs.io
      - distributedpolicies.run.ai
      - distributedworkloads.run.ai
      - domainmappings.serving.knative.dev
      - etcdclusters.etcd.database.coreos.com
      - etcdrecoveries.containerstorage.azure.com
      - extensionconfigs.clusterconfig.azure.com
      - externalworkloads.run.ai
      - hostdevicenetworks.mellanox.com
      - images.caching.internal.knative.dev
      - inferencepolicies.run.ai
      - inferenceworkloads.run.ai
      - ingresses.networking.internal.knative.dev
      - interactivepolicies.run.ai
      - interactiveworkloads.run.ai
      - ipoibnetworks.mellanox.com
      - ippools.nv-ipam.nvidia.com
      - issuers.cert-manager.io
      - jaegers.jaegertracing.io
      - macvlannetworks.mellanox.com
      - metrics.autoscaling.internal.knative.dev
      - mpijobs.kubeflow.org
      - mxjobs.kubeflow.org
      - network-attachment-definitions.k8s.cni.cncf.io
      - nicclusterpolicies.mellanox.com
      - nodefeaturegroups.nfd.k8s-sigs.io
      - nodefeaturerules.nfd.k8s-sigs.io
      - nodefeatures.nfd.k8s-sigs.io
      - nodenetworkconfigs.acn.azure.com
      - nodepools.run.ai
      - nvidiadrivers.nvidia.com
      - orders.acme.cert-manager.io
      - paddlejobs.kubeflow.org
      - podautoscalers.autoscaling.internal.knative.dev
      - podgroups.scheduling.run.ai
      - podlogs.monitoring.grafana.com
      - podmonitors.monitoring.coreos.com
      - policies.kyverno.io
      - policyexceptions.kyverno.io
      - policyreports.wgpolicyk8s.io
      - probes.monitoring.coreos.com
      - projects.run.ai
      - prometheusagents.monitoring.coreos.com
      - prometheuses.monitoring.coreos.com
      - prometheusrules.monitoring.coreos.com
      - pytorchjobs.kubeflow.org
      - queues.scheduling.run.ai
      - revisions.serving.knative.dev
      - routes.serving.knative.dev
      - runaiconfigs.run.ai
      - runaidgxclogexporters.runai.dgxc.nvidia.com
      - runaidgxcnetworkpolicies.runai.dgxc.nvidia.com
      - runaidgxcstorages.runai.dgxc.nvidia.com
      - runaijobs.run.ai
      - schedulingshards.engine.run.ai
      - scrapeconfigs.monitoring.coreos.com
      - secretproviderclasses.secrets-store.csi.x-k8s.io
      - secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
      - serverlessservices.networking.internal.knative.dev
      - servicemonitors.monitoring.coreos.com
      - services.serving.knative.dev
      - skyhooks.skyhook.nvidia.com
      - storagepools.containerstorage.azure.com
      - tfjobs.kubeflow.org
      - thanosrulers.monitoring.coreos.com
      - trainingpolicies.run.ai
      - trainingworkloads.run.ai
      - updaterequests.kyverno.io
      - volumesnapshotclasses.snapshot.storage.k8s.io
      - volumesnapshotcontents.snapshot.storage.k8s.io
      - volumesnapshots.snapshot.storage.k8s.io
      - xgboostjobs.kubeflow.org
  - apiGroup: mellanox.com
    kind: HostDeviceNetwork
    resources:
      - hostdevicenetworks
      - hostdevicenetworks/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: mellanox.com
    kind: IPoIBNetwork
    resources:
      - ipoibnetworks
      - ipoibnetworks/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: networking.k8s.io
    kind: IngressClass
    resources:
      - ingressclasses
    verbs:
      # - create
      # - delete
      # - deletecollection
      - get
      - list
      # - patch
      # - update
      - watch
    systemResources:
      - nginx
  - apiGroup: mellanox.com
    kind: MacvlanNetwork
    resources:
      - macvlannetworks
      - macvlannetworks/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: ""
    kind: Namespace
    resources:
      - namespaces
      - namespaces/finalize
      - namespaces/status
    verbs:
      - "*"
    systemResources:
      - acstor
      - argocd
      - azure-extensions-usage-system
      - cert-manager
      - default
      - dgxc-admission-controller
      - dgxc-logging
      - dgxc-tenant-cluster-policies
      - gpu-operator
      - ingress-nginx
      - knative-serving
      - kourier-system
      - kube-node-lease
      - kube-oidc-proxy
      - kube-public
      - kube-system
      - kubeflow
      - kyverno
      - mpi-operator
      - network-operator
      - ngcc-csi-lvm
      - nvdiag
      - nvsentinel
      - observability
      - prometheus
      - runai
      - skyhook
  - apiGroup: mellanox.com
    kind: NicClusterPolicy
    resources:
      - nicclusterpolicies
      - nicclusterpolicies/status
    verbs:
      - "*"
    systemResources:
      - nic-cluster-policy
  - apiGroup: ""
    kind: PersistentVolume
    resources:
      - persistentvolumes
      - persistentvolumes/status
    verbs:
      # - create
      # - delete
      # - deletecollection
      - get
      - list
      # - patch
      # - update
      - watch
    systemResources:
      - pvc-09658801-ecb4-4df6-a922-a744e01aa739
      - pvc-243e7721-54d1-4c2c-b0f3-6304e5568571
      - pvc-5910d71c-6c60-408b-ac17-a2a6929579ed
      - pvc-d0bef359-dc21-4a5e-8ae8-c9a54509e5ae
      - pvc-d4435c08-216a-4281-859c-26de19b98fc9
  - apiGroup: scheduling.k8s.io
    kind: PriorityClass
    resources:
      - priorityclasses
    verbs:
      - "*"
    systemResources:
      - build
      - inference
      - interactive-preemptible
      - runai-critical
      - runai-engine-critical
      - system-cluster-critical
      - system-node-critical
      - train
      - train-critical
      - train-high
  - apiGroup: authorization.k8s.io
    kind: SelfSubjectAccessReview
    resources:
      - selfsubjectaccessreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authentication.k8s.io
    kind: SelfSubjectReview
    resources:
      - selfsubjectreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authorization.k8s.io
    kind: SelfSubjectRulesReview
    resources:
      - selfsubjectrulesreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authorization.k8s.io
    kind: SubjectAccessReview
    resources:
      - subjectaccessreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authentication.k8s.io
    kind: TokenReview
    resources:
      - tokenreviews
    verbs:
      - "*"
    systemResources: []

namespacedKinds:
  - apiGroup: policy
    resources:
      - pods/eviction
    verbs:
      - create
  - apiGroup: ""
    kind: Binding
    resources:
      - bindings
    verbs:
      - "*"
  - apiGroup: ""
    kind: ConfigMap
    resources:
      - configmaps
    verbs:
      - "*"
  - apiGroup: apps
    kind: ControllerRevision
    resources:
      - controllerrevisions
    verbs:
      - "*"
  - apiGroup: batch
    kind: CronJob
    resources:
      - cronjobs
      - cronjobs/status
    verbs:
      - "*"
  - apiGroup: apps
    kind: DaemonSet
    resources:
      - daemonsets
      - daemonsets/status
    verbs:
      - "*"
  - apiGroup: apps
    kind: Deployment
    resources:
      - deployments
      - deployments/scale
      - deployments/status
    verbs:
      - "*"
  - apiGroup: discovery.k8s.io
    kind: EndpointSlice
    resources:
      - endpointslices
    verbs:
      - "*"
  - apiGroup: ""
    kind: Endpoints
    resources:
      - endpoints
    verbs:
      - "*"
  - apiGroup: ""
    kind: Event
    resources:
      - events
    verbs:
      - "*"
  - apiGroup: events.k8s.io
    kind: Event
    resources:
      - events
    verbs:
      - "*"
  - apiGroup: autoscaling
    kind: HorizontalPodAutoscaler
    resources:
      - horizontalpodautoscalers
      - horizontalpodautoscalers/status
    verbs:
      - "*"
  - apiGroup: networking.k8s.io
    kind: Ingress
    resources:
      - ingresses
      - ingresses/status
    verbs:
      - "*"
  - apiGroup: batch
    kind: Job
    resources:
      - jobs
      - jobs/status
    verbs:
      - "*"
  - apiGroup: coordination.k8s.io
    kind: Lease
    resources:
      - leases
    verbs:
      - "*"
  - apiGroup: ""
    kind: LimitRange
    resources:
      - limitranges
    verbs:
      - "*"
  - apiGroup: authorization.k8s.io
    kind: LocalSubjectAccessReview
    resources:
      - localsubjectaccessreviews
    verbs:
      - "*"
  - apiGroup: networking.k8s.io
    kind: NetworkPolicy
    resources:
      - networkpolicies
    verbs:
      - "*"
  - apiGroup: ""
    kind: PersistentVolumeClaim
    resources:
      - persistentvolumeclaims
      - persistentvolumeclaims/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: Pod
    resources:
      - pods
      - pods/attach
      - pods/binding
      - pods/ephemeralcontainers
      - pods/eviction
      - pods/exec
      - pods/log
      - pods/portforward
      - pods/proxy
      - pods/status
    verbs:
      - "*"
  - apiGroup: policy
    kind: PodDisruptionBudget
    resources:
      - poddisruptionbudgets
      - poddisruptionbudgets/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: PodTemplate
    resources:
      - podtemplates
    verbs:
      - "*"
  - apiGroup: apps
    kind: ReplicaSet
    resources:
      - replicasets
      - replicasets/scale
      - replicasets/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ReplicationController
    resources:
      - replicationcontrollers
      - replicationcontrollers/scale
      - replicationcontrollers/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ResourceQuota
    resources:
      - resourcequotas
      - resourcequotas/status
    verbs:
      - "*"
  - apiGroup: rbac.authorization.k8s.io
    kind: Role
    resources:
      - roles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - bind
      # - escalate
  - apiGroup: rbac.authorization.k8s.io
    kind: RoleBinding
    resources:
      - rolebindings
    verbs:
      - "*"
  - apiGroup: ""
    kind: Secret
    resources:
      - secrets
    verbs:
      - "*"
  - apiGroup: ""
    kind: Service
    resources:
      - services
      - services/proxy
      - services/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ServiceAccount
    resources:
      - serviceaccounts
      - serviceaccounts/token
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - impersonate
  - apiGroup: apps
    kind: StatefulSet
    resources:
      - statefulsets
      - statefulsets/scale
      - statefulsets/status
    verbs:
      - "*"

systemSubjects:
  User:
    - aks-support
    - clusterAdmin
    - clusterMonitoringUser
    - clusterUser
    - hcpService
    - konnectivity-prometheus-client
    - kyverno@test.com
    - ladithyav@nvidia.com
    - pwittrock@nvidia.com
    - system:kube-controller-manager
    - system:kube-proxy
    - system:kube-scheduler
  Group:
    - 07d60667-263d-401a-8b36-119b74fbb6b1
    - 93bb39a4-e70f-489f-8d9e-b08bbc8f557
    - 93bb39a4-e70f-489f-8d9e-b08bbc8f557b
    - aece7cfa-d4e2-48f4-a812-3053722e561b
    - ed8eca09-efb9-4909-9e73-295d09445297
    - system:bootstrappers
    - system:masters
    - system:monitoring
    - system:nodes
    - system:serviceaccounts
    - system:serviceaccounts:network-operator
    - system:unauthenticated