####################################################################
##### The portion below this marker is automatically generated #####
#####                    DO NOT EDIT BY HAND                   #####
####################################################################

clusterScopedKinds:
  - apiGroup: extensions
    resources:
      - ingresses
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
    systemResources: []
  - apiGroup: ""
    resources:
      - persistentvolumeclaims/finalizers
    verbs:
      - create
      - update
      - delete
      - get
    systemResources: []
  - apiGroup: argoproj.io
    resources:
      - eventsources
      - sensors
    verbs:
      - "*"
    systemResources: []
  - apiGroup: route.openshift.io
    resources:
      - "*"
    verbs:
      - "*"
    systemResources: []
  - apiGroup: ""
    resources:
      - configmaps/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: nvidia.com
    kind: ClusterPolicy
    resources:
      - clusterpolicies
      - clusterpolicies/status
    verbs:
      - "*"
    systemResources:
      - cluster-policy
  - apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    resources:
      - clusterroles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - bind 
      # - escalate 
    systemResources:
      - admin
      - argocd-application-controller
      - argocd-notifications-controller
      - argocd-server
      - assets-sync
      - assets-sync-cluster
      - aws-node
      - aws-secrets-store-csi-driver-secrets-store-csi-driver-provider-cluster-role
      - cert-manager-cainjector
      - cert-manager-cluster-view
      - cert-manager-controller-approve:cert-manager-io
      - cert-manager-controller-certificates
      - cert-manager-controller-certificatesigningrequests
      - cert-manager-controller-challenges
      - cert-manager-controller-clusterissuers
      - cert-manager-controller-ingress-shim
      - cert-manager-controller-issuers
      - cert-manager-controller-orders
      - cert-manager-edit
      - cert-manager-view
      - cert-manager-webhook:subjectaccessreviews
      - cluster-admin
      - cluster-sync
      - cluster-sync-project
      - dgxc-admission-controller
      - dgxc-customer-app-admin
      - dgxc-customer-app-admin-base
      - dgxc-customer-network-policy
      - dgxc-exporter
      - dgxc-logging-alloy
      - dgxc-runai-controller
      - ebs-csi-node-role
      - ebs-external-attacher-role
      - ebs-external-provisioner-role
      - ebs-external-resizer-role
      - ebs-external-snapshotter-role
      - edit
      - eks:addon-manager
      - eks:az-poller
      - eks:certificate-controller-approver
      - eks:certificate-controller-manager
      - eks:certificate-controller-signer
      - eks:cloud-controller-manager
      - eks:cloud-provider-extraction-migration
      - eks:cluster-event-watcher
      - eks:coredns-autoscaler
      - eks:extension-metrics-apiserver
      - eks:fargate-manager
      - eks:fargate-scheduler
      - eks:k8s-metrics
      - eks:network-policy-controller
      - eks:network-webhooks
      - eks:node-bootstrapper
      - eks:node-manager
      - eks:nodewatcher
      - eks:pod-identity-mutating-webhook
      - eks:service-operations
      - eks:tagging-controller
      - fsx-csi-external-provisioner-role
      - fsx-csi-node-role
      - fsx-external-resizer-role
      - gpu-operator
      - gpu-operator-node-feature-discovery
      - gpu-operator-node-feature-discovery-gc
      - ingress-nginx
      - knative-serving-activator-cluster
      - knative-serving-addressable-resolver
      - knative-serving-admin
      - knative-serving-aggregated-addressable-resolver
      - knative-serving-core
      - knative-serving-namespaced-admin
      - knative-serving-namespaced-edit
      - knative-serving-namespaced-view
      - knative-serving-podspecable-binding
      - kratos-fluent-bit-read
      - kubeflow-mpijobs-admin
      - kubeflow-mpijobs-edit
      - kubeflow-mpijobs-view
      - kyverno-cleanup-jobs
      - kyverno:admission-controller
      - kyverno:admission-controller:additional
      - kyverno:admission-controller:core
      - kyverno:background-controller
      - kyverno:background-controller:additional
      - kyverno:background-controller:core
      - kyverno:cleanup-controller
      - kyverno:cleanup-controller:core
      - kyverno:dgxc-integrations
      - kyverno:rbac:admin:policies
      - kyverno:rbac:admin:policyreports
      - kyverno:rbac:admin:reports
      - kyverno:rbac:admin:updaterequests
      - kyverno:rbac:view:policies
      - kyverno:rbac:view:policyreports
      - kyverno:rbac:view:reports
      - kyverno:rbac:view:updaterequests
      - kyverno:reports-controller
      - kyverno:reports-controller:core
      - kyverno:watch-update-namespaces
      - kyverno:watch-update-services
      - metrics-exporter
      - mpi-operator
      - net-kourier
      - node-problem-detector-cpu
      - node-problem-detector-gpu
      - node-scale-adjuster-ro
      - nodepool-controller
      - nvidia-device-plugin
      - nvidia-device-plugin-mps-control-daemon
      - nvidia-driver
      - nvidia-gpu-feature-discovery
      - nvidia-mig-manager
      - nvidia-operator-validator
      - nvsentinel
      - pod-group-assigner
      - pod-group-controller
      - pod-group-controller-ro
      - pod-grouper
      - prometheus-kube-state-metrics
      - prometheus-operator
      - prometheus-prometheus
      - queue-controller
      - researcher-service-ro
      - researcher-service-rw
      - runai-accessrule-controller
      - runai-accessrule-controller-project
      - runai-admission-controller-project
      - runai-admission-controller-ro
      - runai-agent
      - runai-binder-cluster-wide
      - runai-binder-project
      - runai-cluster-api
      - runai-cluster-api-project
      - runai-compute-resource-administrator
      - runai-compute-resource-administrator-ns
      - runai-compute-resource-administrator-runai
      - runai-credentials-administrator
      - runai-credentials-administrator-ns
      - runai-credentials-administrator-runai
      - runai-data-source-administrator
      - runai-data-source-administrator-ns
      - runai-data-source-administrator-runai
      - runai-data-source-administrator-runai-cs
      - runai-data-volume-administrator
      - runai-data-volume-administrator-ns
      - runai-data-volume-administrator-runai
      - runai-department-administrator
      - runai-department-administrator-ns
      - runai-department-administrator-runai
      - runai-department-viewer
      - runai-department-viewer-ns
      - runai-department-viewer-runai
      - runai-device-plugin
      - runai-editor
      - runai-editor-ns
      - runai-editor-runai
      - runai-engine-operator
      - runai-environment-administrator
      - runai-environment-administrator-ns
      - runai-environment-administrator-runai
      - runai-external-workload-integrator
      - runai-external-workload-integrator-project
      - runai-inference-workload-controller
      - runai-inference-workload-controller-project
      - runai-init-ca
      - runai-job-controller
      - runai-job-controller-project
      - runai-l1-researcher
      - runai-l1-researcher-ns
      - runai-l1-researcher-runai
      - runai-l2-researcher
      - runai-l2-researcher-ns
      - runai-l2-researcher-runai
      - runai-mig-parted
      - runai-ml-engineer
      - runai-ml-engineer-ns
      - runai-ml-engineer-runai
      - runai-operator
      - runai-project-controller
      - runai-project-controller-cluster-pvc
      - runai-project-controller-cluster-pvc-per-project
      - runai-project-controller-cluster-secret
      - runai-project-controller-cluster-secret-per-project
      - runai-project-controller-limit-range
      - runai-project-controller-limit-range-per-project
      - runai-project-controller-ns-creation
      - runai-project-controller-resources-patcher
      - runai-project-controller-rolebinding-creation
      - runai-project-controller-servicemonitor-creation
      - runai-prometheus
      - runai-research-manager
      - runai-research-manager-ns
      - runai-research-manager-runai
      - runai-resource-reservation-rw
      - runai-scheduler-ro
      - runai-scheduler-rw
      - runai-shared-objects-controller
      - runai-shared-objects-controller-project
      - runai-system-administrator
      - runai-system-administrator-ns
      - runai-system-administrator-runai
      - runai-system-administrator-runai-cs
      - runai-template-administrator
      - runai-template-administrator-ns
      - runai-template-administrator-runai
      - runai-viewer
      - runai-viewer-ns
      - runai-viewer-runai
      - runai-workload-exporter
      - s3-csi-driver-cluster-role
      - secretproviderclasses-admin-role
      - secretproviderclasses-role
      - secretproviderclasses-viewer-role
      - secretproviderclasspodstatuses-viewer-role
      - shoreline-agent
      - skyhook-operator-manager-role
      - skyhook-operator-metrics-reader
      - skyhook-operator-proxy-role
      - sre-cluster-scoped-access
      - status-updater
      - status-updater-ro
      - system:aggregate-to-admin
      - system:aggregate-to-edit
      - system:aggregate-to-view
      - system:auth-delegator
      - system:basic-user
      - system:certificates.k8s.io:certificatesigningrequests:nodeclient
      - system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
      - system:certificates.k8s.io:kube-apiserver-client-approver
      - system:certificates.k8s.io:kube-apiserver-client-kubelet-approver
      - system:certificates.k8s.io:kubelet-serving-approver
      - system:certificates.k8s.io:legacy-unknown-approver
      - system:controller:attachdetach-controller
      - system:controller:certificate-controller
      - system:controller:clusterrole-aggregation-controller
      - system:controller:cronjob-controller
      - system:controller:daemon-set-controller
      - system:controller:deployment-controller
      - system:controller:disruption-controller
      - system:controller:endpoint-controller
      - system:controller:endpointslice-controller
      - system:controller:endpointslicemirroring-controller
      - system:controller:ephemeral-volume-controller
      - system:controller:expand-controller
      - system:controller:generic-garbage-collector
      - system:controller:horizontal-pod-autoscaler
      - system:controller:job-controller
      - system:controller:legacy-service-account-token-cleaner
      - system:controller:namespace-controller
      - system:controller:node-controller
      - system:controller:persistent-volume-binder
      - system:controller:pod-garbage-collector
      - system:controller:pv-protection-controller
      - system:controller:pvc-protection-controller
      - system:controller:replicaset-controller
      - system:controller:replication-controller
      - system:controller:resourcequota-controller
      - system:controller:root-ca-cert-publisher
      - system:controller:route-controller
      - system:controller:service-account-controller
      - system:controller:service-controller
      - system:controller:statefulset-controller
      - system:controller:ttl-after-finished-controller
      - system:controller:ttl-controller
      - system:controller:validatingadmissionpolicy-status-controller
      - system:coredns
      - system:discovery
      - system:heapster
      - system:kube-aggregator
      - system:kube-controller-manager
      - system:kube-dns
      - system:kube-scheduler
      - system:kubelet-api-admin
      - system:monitoring
      - system:node
      - system:node-bootstrapper
      - system:node-problem-detector
      - system:node-proxier
      - system:persistent-volume-provisioner
      - system:public-info-viewer
      - system:service-account-issuer-discovery
      - system:volume-scheduler
      - training-operator
      - vace-role
      - view
      - vpc-resource-controller-role
      - workload-controller-ro
      - workload-controller-rw
      - workload-overseer
  - apiGroup: rbac.authorization.k8s.io
    kind: ClusterRoleBinding
    resources:
      - clusterrolebindings
    verbs:
      - "*"
    systemResources:
      - argocd-application-controller
      - argocd-notifications-controller
      - argocd-server
      - assets-sync
      - aws-node
      - aws-secrets-store-csi-driver-secrets-store-csi-driver-provider-cluster-role-binding
      - cert-manager-cainjector
      - cert-manager-controller-approve:cert-manager-io
      - cert-manager-controller-certificates
      - cert-manager-controller-certificatesigningrequests
      - cert-manager-controller-challenges
      - cert-manager-controller-clusterissuers
      - cert-manager-controller-ingress-shim
      - cert-manager-controller-issuers
      - cert-manager-controller-orders
      - cert-manager-webhook:subjectaccessreviews
      - cluster-admin
      - cluster-sync
      - dgxc-admission-controller
      - dgxc-customer-app-admin
      # - dgxc-customer-app-admin-access 
      - dgxc-exporter
      - dgxc-logging-alloy
      - dgxc-runai-controller
      - ebs-csi-attacher-binding
      - ebs-csi-node-getter-binding
      - ebs-csi-provisioner-binding
      - ebs-csi-resizer-binding
      - ebs-csi-snapshotter-binding
      - eks:addon-cluster-admin
      - eks:addon-manager
      - eks:az-poller
      - eks:certificate-controller
      - eks:certificate-controller-approver
      - eks:certificate-controller-manager
      - eks:certificate-controller-signer
      - eks:cloud-controller-manager
      - eks:cloud-provider-extraction-migration
      - eks:cluster-event-watcher
      - eks:coredns-autoscaler
      - eks:extension-metrics-apiserver
      - eks:extension-metrics-apiserver-auth-delegator
      - eks:fargate-manager
      - eks:fargate-scheduler
      - eks:k8s-metrics
      - eks:kube-proxy
      - eks:kube-proxy-fargate
      - eks:kube-proxy-windows
      - eks:network-policy-controller
      - eks:network-webhooks
      - eks:node-bootstrapper
      - eks:node-manager
      - eks:nodewatcher
      - eks:pod-identity-mutating-webhook
      - eks:service-operations
      - eks:tagging-controller
      - fsx-csi-external-provisioner-binding
      - fsx-csi-node-getter-binding
      - fsx-csi-resizer-binding
      - gpu-operator
      - gpu-operator-node-feature-discovery
      - gpu-operator-node-feature-discovery-gc
      - ingress-nginx
      - knative-serving-activator-cluster
      - knative-serving-controller-addressable-resolver
      - knative-serving-controller-admin
      - kratos-fluent-bit-read
      - kyverno-cleanup-jobs
      - kyverno:admission-controller
      - kyverno:background-controller
      - kyverno:cleanup-controller
      - kyverno:reports-controller
      - metrics-exporter
      - mountpoint-s3-csi-node-binding
      - mpi-operator
      - net-kourier
      - node-problem-detector-cpu
      - node-problem-detector-gpu
      - node-scale-adjuster-ro
      - nodepool-controller
      - nvidia-device-plugin
      - nvidia-device-plugin-mps-control-daemon
      - nvidia-driver
      - nvidia-gpu-feature-discovery
      - nvidia-mig-manager
      - nvidia-operator-validator
      - nvsentinel
      - nvsentinel-sa-view-binding
      - nvsentinel-shoreline
      - pod-group-assigner
      - pod-group-controller-ro
      - pod-grouper
      - prometheus-kube-state-metrics
      - prometheus-operator
      - prometheus-prometheus
      - queue-controller
      - researcher-service-ro
      - runai-accessrule-controller
      - runai-admission-controller-ro
      - runai-agent
      - runai-binder-cluster-wide
      - runai-cluster-api
      - runai-compute-resource-administrator
      - runai-credentials-administrator
      - runai-data-source-administrator
      - runai-data-volume-administrator
      - runai-department-administrator
      - runai-department-viewer
      - runai-device-plugin
      - runai-editor
      - runai-engine-operator
      - runai-environment-administrator
      - runai-external-workload-integrator
      - runai-inference-workload-controller
      - runai-init-ca
      - runai-job-controller
      - runai-l1-researcher
      - runai-l2-researcher
      - runai-mig-parted
      - runai-ml-engineer
      - runai-operator
      - runai-project-controller
      - runai-project-controller-cluster-pvc
      - runai-project-controller-cluster-secret
      - runai-project-controller-limit-range
      - runai-project-controller-ns-creation
      - runai-project-controller-rolebinding-creation
      - runai-project-controller-servicemonitor-creation
      - runai-prometheus
      - runai-research-manager
      - runai-scheduler-ro
      - runai-shared-objects-controller
      - runai-system-administrator
      - runai-template-administrator
      - runai-viewer
      - runai-workload-exporter
      - secretproviderclasses-rolebinding
      - skyhook-operator-manager-rolebinding
      - skyhook-operator-proxy-rolebinding
      - sre-cluster-scoped-access
      - sre-full-access-binding
      - status-updater-ro
      - system:basic-user
      - system:controller:attachdetach-controller
      - system:controller:certificate-controller
      - system:controller:clusterrole-aggregation-controller
      - system:controller:cronjob-controller
      - system:controller:daemon-set-controller
      - system:controller:deployment-controller
      - system:controller:disruption-controller
      - system:controller:endpoint-controller
      - system:controller:endpointslice-controller
      - system:controller:endpointslicemirroring-controller
      - system:controller:ephemeral-volume-controller
      - system:controller:expand-controller
      - system:controller:generic-garbage-collector
      - system:controller:horizontal-pod-autoscaler
      - system:controller:job-controller
      - system:controller:legacy-service-account-token-cleaner
      - system:controller:namespace-controller
      - system:controller:node-controller
      - system:controller:persistent-volume-binder
      - system:controller:pod-garbage-collector
      - system:controller:pv-protection-controller
      - system:controller:pvc-protection-controller
      - system:controller:replicaset-controller
      - system:controller:replication-controller
      - system:controller:resourcequota-controller
      - system:controller:root-ca-cert-publisher
      - system:controller:route-controller
      - system:controller:service-account-controller
      - system:controller:service-controller
      - system:controller:statefulset-controller
      - system:controller:ttl-after-finished-controller
      - system:controller:ttl-controller
      - system:controller:validatingadmissionpolicy-status-controller
      - system:coredns
      - system:discovery
      - system:kube-controller-manager
      - system:kube-dns
      - system:kube-scheduler
      - system:monitoring
      - system:node
      - system:node-proxier
      - system:public-info-viewer
      - system:service-account-issuer-discovery
      - system:volume-scheduler
      - training-operator
      - vace-rolebinding
      - vpc-resource-controller-rolebinding
      - workload-controller-ro
      - workload-overseer
  - apiGroup: ""
    kind: ComponentStatus
    resources:
      - componentstatuses
    verbs:
      - "*"
    systemResources:
      - etcd-0
      - scheduler
      - controller-manager
  - apiGroup: apiextensions.k8s.io
    kind: CustomResourceDefinition
    resources:
      - customresourcedefinitions
      - customresourcedefinitions/status
    verbs:
      - "*"
    systemResources:
      - accessrules.run.ai
      - admissionreports.kyverno.io
      - alertmanagerconfigs.monitoring.coreos.com
      - alertmanagers.monitoring.coreos.com
      - applications.argoproj.io
      - applicationsets.argoproj.io
      - appprojects.argoproj.io
      - backgroundscanreports.kyverno.io
      - bindrequests.scheduling.run.ai
      - certificaterequests.cert-manager.io
      - certificates.cert-manager.io
      - certificates.networking.internal.knative.dev
      - challenges.acme.cert-manager.io
      - cleanuppolicies.kyverno.io
      - clusteradmissionreports.kyverno.io
      - clusterbackgroundscanreports.kyverno.io
      - clustercleanuppolicies.kyverno.io
      - clusterdomainclaims.networking.internal.knative.dev
      - clusterissuers.cert-manager.io
      - clusterpolicies.kyverno.io
      - clusterpolicies.nvidia.com
      - clusterpolicyreports.wgpolicyk8s.io
      - cninodes.vpcresources.k8s.aws
      - configs.engine.run.ai
      - configurations.serving.knative.dev
      - datavolumes.run.ai
      - departments.scheduling.run.ai
      - distributedpolicies.run.ai
      - distributedworkloads.run.ai
      - domainmappings.serving.knative.dev
      - eniconfigs.crd.k8s.amazonaws.com
      - externalworkloads.run.ai
      - images.caching.internal.knative.dev
      - inferencepolicies.run.ai
      - inferenceworkloads.run.ai
      - ingresses.networking.internal.knative.dev
      - interactivepolicies.run.ai
      - interactiveworkloads.run.ai
      - issuers.cert-manager.io
      - metrics.autoscaling.internal.knative.dev
      - mpijobs.kubeflow.org
      - mxjobs.kubeflow.org
      - nodefeaturegroups.nfd.k8s-sigs.io
      - nodefeaturerules.nfd.k8s-sigs.io
      - nodefeatures.nfd.k8s-sigs.io
      - nodepools.run.ai
      - nvidiadrivers.nvidia.com
      - orders.acme.cert-manager.io
      - paddlejobs.kubeflow.org
      - podautoscalers.autoscaling.internal.knative.dev
      - podgroups.scheduling.run.ai
      - podlogs.monitoring.grafana.com
      - podmonitors.monitoring.coreos.com
      - policies.kyverno.io
      - policyendpoints.networking.k8s.aws
      - policyexceptions.kyverno.io
      - policyreports.wgpolicyk8s.io
      - probes.monitoring.coreos.com
      - projects.run.ai
      - prometheusagents.monitoring.coreos.com
      - prometheuses.monitoring.coreos.com
      - prometheusrules.monitoring.coreos.com
      - pytorchjobs.kubeflow.org
      - queues.scheduling.run.ai
      - revisions.serving.knative.dev
      - routes.serving.knative.dev
      - runaiconfigs.run.ai
      - runaidgxclogexporters.runai.dgxc.nvidia.com
      - runaidgxcnetworkpolicies.runai.dgxc.nvidia.com
      - runaidgxcstorages.runai.dgxc.nvidia.com
      - runaijobs.run.ai
      - schedulingshards.engine.run.ai
      - scrapeconfigs.monitoring.coreos.com
      - secretproviderclasses.secrets-store.csi.x-k8s.io
      - secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
      - securitygrouppolicies.vpcresources.k8s.aws
      - serverlessservices.networking.internal.knative.dev
      - servicemonitors.monitoring.coreos.com
      - services.serving.knative.dev
      - skyhooks.skyhook.nvidia.com
      - tfjobs.kubeflow.org
      - thanosrulers.monitoring.coreos.com
      - trainingpolicies.run.ai
      - trainingworkloads.run.ai
      - updaterequests.kyverno.io
      - xgboostjobs.kubeflow.org
  - apiGroup: crd.k8s.amazonaws.com
    kind: ENIConfig
    resources:
      - eniconfigs
    verbs:
      - "*"
    systemResources: []
  - apiGroup: networking.k8s.io
    kind: IngressClass
    resources:
      - ingressclasses
    verbs:
      # - create 
      # - delete 
      # - deletecollection 
      - get
      - list
      # - patch 
      # - update 
      - watch
    systemResources:
      - nginx
  - apiGroup: ""
    kind: Namespace
    resources:
      - namespaces
      - namespaces/finalize
      - namespaces/status
    verbs:
      - "*"
    systemResources:
      - argocd
      - cert-manager
      - default
      - dgxc-admission-controller
      - dgxc-cluster-validator
      - dgxc-logging
      - dgxc-tenant-cluster-policies
      - gpu-operator
      - ingress-nginx
      - knative-serving
      - kourier-system
      - kube-node-lease
      - kube-public
      - kube-system
      - kubeflow
      - kyverno
      - monitoring
      - mpi-operator
      - node-problem-detector
      - nvdiag
      - nvsentinel
      - observability
      - prometheus
      - runai
      - skyhook
  - apiGroup: ""
    kind: PersistentVolume
    resources:
      - persistentvolumes
      - persistentvolumes/status
    verbs:
      # - create 
      # - delete 
      # - deletecollection 
      - get
      - list
      # - patch 
      # - update 
      - watch
    systemResources: []
  - apiGroup: scheduling.k8s.io
    kind: PriorityClass
    resources:
      - priorityclasses
    verbs:
      - "*"
    systemResources:
      - build
      - inference
      - interactive-preemptible
      - runai-critical
      - runai-engine-critical
      - system-cluster-critical
      - system-node-critical
      - train
      - train-critical
      - train-high
  - apiGroup: authorization.k8s.io
    kind: SelfSubjectAccessReview
    resources:
      - selfsubjectaccessreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authentication.k8s.io
    kind: SelfSubjectReview
    resources:
      - selfsubjectreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authorization.k8s.io
    kind: SelfSubjectRulesReview
    resources:
      - selfsubjectrulesreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authorization.k8s.io
    kind: SubjectAccessReview
    resources:
      - subjectaccessreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authentication.k8s.io
    kind: TokenReview
    resources:
      - tokenreviews
    verbs:
      - "*"
    systemResources: []

namespacedKinds:
  - apiGroup: policy
    resources:
      - pods/eviction
    verbs:
      - create
  - apiGroup: ""
    kind: Binding
    resources:
      - bindings
    verbs:
      - "*"
  - apiGroup: ""
    kind: ConfigMap
    resources:
      - configmaps
    verbs:
      - "*"
  - apiGroup: apps
    kind: ControllerRevision
    resources:
      - controllerrevisions
    verbs:
      - "*"
  - apiGroup: batch
    kind: CronJob
    resources:
      - cronjobs
      - cronjobs/status
    verbs:
      - "*"
  - apiGroup: apps
    kind: DaemonSet
    resources:
      - daemonsets
      - daemonsets/status
    verbs:
      - "*"
  - apiGroup: apps
    kind: Deployment
    resources:
      - deployments
      - deployments/scale
      - deployments/status
    verbs:
      - "*"
  - apiGroup: discovery.k8s.io
    kind: EndpointSlice
    resources:
      - endpointslices
    verbs:
      - "*"
  - apiGroup: ""
    kind: Endpoints
    resources:
      - endpoints
    verbs:
      - "*"
  - apiGroup: ""
    kind: Event
    resources:
      - events
    verbs:
      - "*"
  - apiGroup: events.k8s.io
    kind: Event
    resources:
      - events
    verbs:
      - "*"
  - apiGroup: autoscaling
    kind: HorizontalPodAutoscaler
    resources:
      - horizontalpodautoscalers
      - horizontalpodautoscalers/status
    verbs:
      - "*"
  - apiGroup: networking.k8s.io
    kind: Ingress
    resources:
      - ingresses
      - ingresses/status
    verbs:
      - "*"
  - apiGroup: batch
    kind: Job
    resources:
      - jobs
      - jobs/status
    verbs:
      - "*"
  - apiGroup: coordination.k8s.io
    kind: Lease
    resources:
      - leases
    verbs:
      - "*"
  - apiGroup: ""
    kind: LimitRange
    resources:
      - limitranges
    verbs:
      - "*"
  - apiGroup: authorization.k8s.io
    kind: LocalSubjectAccessReview
    resources:
      - localsubjectaccessreviews
    verbs:
      - "*"
  - apiGroup: networking.k8s.io
    kind: NetworkPolicy
    resources:
      - networkpolicies
    verbs:
      - "*"
  - apiGroup: ""
    kind: PersistentVolumeClaim
    resources:
      - persistentvolumeclaims
      - persistentvolumeclaims/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: Pod
    resources:
      - pods
      - pods/attach
      - pods/binding
      - pods/ephemeralcontainers
      - pods/eviction
      - pods/exec
      - pods/log
      - pods/portforward
      - pods/proxy
      - pods/status
    verbs:
      - "*"
  - apiGroup: policy
    kind: PodDisruptionBudget
    resources:
      - poddisruptionbudgets
      - poddisruptionbudgets/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: PodTemplate
    resources:
      - podtemplates
    verbs:
      - "*"
  - apiGroup: apps
    kind: ReplicaSet
    resources:
      - replicasets
      - replicasets/scale
      - replicasets/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ReplicationController
    resources:
      - replicationcontrollers
      - replicationcontrollers/scale
      - replicationcontrollers/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ResourceQuota
    resources:
      - resourcequotas
      - resourcequotas/status
    verbs:
      - "*"
  - apiGroup: rbac.authorization.k8s.io
    kind: Role
    resources:
      - roles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - bind 
      # - escalate 
  - apiGroup: rbac.authorization.k8s.io
    kind: RoleBinding
    resources:
      - rolebindings
    verbs:
      - "*"
  - apiGroup: ""
    kind: Secret
    resources:
      - secrets
    verbs:
      - "*"
  - apiGroup: ""
    kind: Service
    resources:
      - services
      - services/proxy
      - services/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ServiceAccount
    resources:
      - serviceaccounts
      - serviceaccounts/token
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - impersonate 
  - apiGroup: apps
    kind: StatefulSet
    resources:
      - statefulsets
      - statefulsets/scale
      - statefulsets/status
    verbs:
      - "*"

systemSubjects:
  User:
    - eks:addon-manager
    - eks:az-poller
    - eks:certificate-controller
    - eks:cloud-controller-manager
    - eks:cluster-event-watcher
    - eks:coredns-autoscaler
    - eks:extension-metrics-apiserver
    - eks:fargate-manager
    - eks:fargate-scheduler
    - eks:k8s-metrics
    - eks:network-policy-controller
    - eks:network-webhooks
    - eks:node-manager
    - eks:nodewatcher
    - eks:pod-identity-mutating-webhook
    - eks:vpc-resource-controller
    - kyverno@test.com
    - ladithyav@nvidia.com
    - pwittrock@nvidia.com
    - system:kube-controller-manager
    - system:kube-proxy
    - system:kube-scheduler
  Group:
    - access-dgx-cloud-runai-non-prod-aws-admin
    - access-dgx-cloud-runai-non-prod-aws-engineer
    - access-dgx-cloud-runai-prod-aws-admin
    - access-dgx-cloud-runai-prod-aws-engineer
    - eks:kube-proxy-windows
    - eks:service-operations
    - system:bootstrappers
    - system:masters
    - system:monitoring
    - system:node-proxier
    - system:nodes
    - system:serviceaccounts
    - system:unauthenticated