####################################################################
##### The portion below this marker is automatically generated #####
#####                    DO NOT EDIT BY HAND                   #####
####################################################################

clusterScopedKinds:
  - apiGroup: argoproj.io
    resources:
      - eventsources
      - sensors
    verbs:
      - "*"
    systemResources: []
  - apiGroup: extensions
    resources:
      - ingresses
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
    systemResources: []
  - apiGroup: ""
    resources:
      - persistentvolumeclaims/finalizers
    verbs:
      - create
      - update
      - delete
      - get
    systemResources: []
  - apiGroup: ""
    resources:
      - configmaps/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: route.openshift.io
    resources:
      - "*"
    verbs:
      - "*"
    systemResources: []
  - apiGroup: nvidia.com
    kind: ClusterPolicy
    resources:
      - clusterpolicies
      - clusterpolicies/status
    verbs:
      - "*"
    systemResources:
      - cluster-policy
  - apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    resources:
      - clusterroles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - bind 
      # - escalate 
    systemResources:
      - admin
      - anet-operator-cluster-role
      - antrea-agent
      - antrea-controller
      - antrea-cpha
      - argocd-application-controller
      - argocd-notifications-controller
      - argocd-server
      - assets-sync
      - assets-sync-cluster
      - ca-cr-actor
      - ca-pr-beta-actor
      - cert-manager-cainjector
      - cert-manager-cluster-view
      - cert-manager-controller-approve:cert-manager-io
      - cert-manager-controller-certificates
      - cert-manager-controller-certificatesigningrequests
      - cert-manager-controller-challenges
      - cert-manager-controller-clusterissuers
      - cert-manager-controller-ingress-shim
      - cert-manager-controller-issuers
      - cert-manager-controller-orders
      - cert-manager-edit
      - cert-manager-view
      - cert-manager-webhook:subjectaccessreviews
      - cilium
      - cilium-win
      - cloud-provider
      - cluster-admin
      - cluster-autoscaler
      - cluster-sync
      - cluster-sync-project
      - dgxc-admission-controller
      - dgxc-customer-app-admin
      - dgxc-customer-app-admin-base
      - dgxc-customer-network-policy
      - dgxc-exporter
      - dgxc-runai-controller
      - edit
      - external-metrics-reader
      - filestorecsi-controller-cluster-role
      - filestorecsi-node-driver-cluster-role
      - filestorecsi-provisioner-role
      - filestorecsi-resizer-role
      - filestorecsi-snapshotter-role
      - fluentbit-gke-pod-label-reader
      - gce:beta:kubelet-certificate-bootstrap
      - gce:beta:kubelet-certificate-rotation
      - gce:cloud-provider
      - gce:gke-metadata-server-reader
      - gcs-fuse-csi-publisher-role
      - gke-oidc-envoy-impersonate
      - gke-oidc-operator-role
      - gke-spiffe-issuer
      - gke-spiffe-user
      - gmp-system:collector
      - gmp-system:operator
      - gpu-operator
      - gpu-operator-node-feature-discovery
      - gpu-operator-node-feature-discovery-gc
      - gpu-operator-upgrade-crd-hook-role
      - ingress-nginx
      - knative-serving-activator-cluster
      - knative-serving-addressable-resolver
      - knative-serving-admin
      - knative-serving-aggregated-addressable-resolver
      - knative-serving-core
      - knative-serving-namespaced-admin
      - knative-serving-namespaced-edit
      - knative-serving-namespaced-view
      - knative-serving-podspecable-binding
      - konnectivity-agent-cpha
      - kratos-fluent-bit-read
      - kubeflow-mpijobs-admin
      - kubeflow-mpijobs-edit
      - kubeflow-mpijobs-view
      - kubelet-api-admin
      - kyverno-cleanup-jobs
      - kyverno:admission-controller
      - kyverno:admission-controller:additional
      - kyverno:admission-controller:core
      - kyverno:background-controller
      - kyverno:background-controller:additional
      - kyverno:background-controller:core
      - kyverno:cleanup-controller
      - kyverno:cleanup-controller:core
      - kyverno:dgxc-integrations
      - kyverno:rbac:admin:policies
      - kyverno:rbac:admin:policyreports
      - kyverno:rbac:admin:reports
      - kyverno:rbac:admin:updaterequests
      - kyverno:rbac:view:policies
      - kyverno:rbac:view:policyreports
      - kyverno:rbac:view:reports
      - kyverno:rbac:view:updaterequests
      - kyverno:reports-controller
      - kyverno:reports-controller:core
      - kyverno:watch-update-namespaces
      - kyverno:watch-update-services
      - maintenance-handler
      - metrics-exporter
      - mpi-operator
      - net-kourier
      - netd
      - node-problem-detector-cpu
      - node-problem-detector-gpu
      - node-scale-adjuster-ro
      - nodepool-controller
      - nvidia-device-plugin
      - nvidia-device-plugin-mps-control-daemon
      - nvidia-gpu-feature-discovery
      - nvidia-mig-manager
      - nvidia-operator-validator
      - pdcsi-attacher-role
      - pdcsi-provisioner-role
      - pdcsi-resizer-role
      - pdcsi-snapshotter-role
      - pod-group-assigner
      - pod-group-controller
      - pod-group-controller-ro
      - pod-grouper
      - pods-list-osmo-agent
      - prometheus-kube-state-metrics
      - prometheus-operator
      - prometheus-prometheus
      - queue-controller
      - read-updateinfo
      - researcher-service-ro
      - researcher-service-rw
      - runai-accessrule-controller
      - runai-accessrule-controller-project
      - runai-admission-controller-project
      - runai-admission-controller-ro
      - runai-agent
      - runai-binder-cluster-wide
      - runai-binder-project
      - runai-cluster-api
      - runai-cluster-api-project
      - runai-compute-resource-administrator
      - runai-compute-resource-administrator-ns
      - runai-compute-resource-administrator-runai
      - runai-credentials-administrator
      - runai-credentials-administrator-ns
      - runai-credentials-administrator-runai
      - runai-data-source-administrator
      - runai-data-source-administrator-ns
      - runai-data-source-administrator-runai
      - runai-data-source-administrator-runai-cs
      - runai-data-volume-administrator
      - runai-data-volume-administrator-ns
      - runai-data-volume-administrator-runai
      - runai-department-administrator
      - runai-department-administrator-ns
      - runai-department-administrator-runai
      - runai-department-viewer
      - runai-department-viewer-ns
      - runai-department-viewer-runai
      - runai-device-plugin
      - runai-editor
      - runai-editor-ns
      - runai-editor-runai
      - runai-engine-operator
      - runai-environment-administrator
      - runai-environment-administrator-ns
      - runai-environment-administrator-runai
      - runai-external-workload-integrator
      - runai-external-workload-integrator-project
      - runai-inference-workload-controller
      - runai-inference-workload-controller-project
      - runai-init-ca
      - runai-job-controller
      - runai-job-controller-project
      - runai-l1-researcher
      - runai-l1-researcher-ns
      - runai-l1-researcher-runai
      - runai-l2-researcher
      - runai-l2-researcher-ns
      - runai-l2-researcher-runai
      - runai-mig-parted
      - runai-ml-engineer
      - runai-ml-engineer-ns
      - runai-ml-engineer-runai
      - runai-operator
      - runai-project-controller
      - runai-project-controller-cluster-pvc
      - runai-project-controller-cluster-pvc-per-project
      - runai-project-controller-cluster-secret
      - runai-project-controller-cluster-secret-per-project
      - runai-project-controller-limit-range
      - runai-project-controller-limit-range-per-project
      - runai-project-controller-ns-creation
      - runai-project-controller-resources-patcher
      - runai-project-controller-rolebinding-creation
      - runai-project-controller-servicemonitor-creation
      - runai-prometheus
      - runai-research-manager
      - runai-research-manager-ns
      - runai-research-manager-runai
      - runai-resource-reservation-rw
      - runai-scheduler-ro
      - runai-scheduler-rw
      - runai-shared-objects-controller
      - runai-shared-objects-controller-project
      - runai-system-administrator
      - runai-system-administrator-ns
      - runai-system-administrator-runai
      - runai-system-administrator-runai-cs
      - runai-template-administrator
      - runai-template-administrator-ns
      - runai-template-administrator-runai
      - runai-viewer
      - runai-viewer-ns
      - runai-viewer-runai
      - runai-workload-exporter
      - secretproviderclasses-role-gke
      - secrets-store-csi-driver-provider-gke-role
      - skyhook-operator-manager-role
      - skyhook-operator-metrics-reader
      - skyhook-operator-proxy-role
      - snapshot-controller-runner
      - sre-cluster-scoped-access
      - status-updater
      - status-updater-ro
      - system:aggregate-to-admin
      - system:aggregate-to-edit
      - system:aggregate-to-view
      - system:anet-manager-cluster-role
      - system:auth-delegator
      - system:basic-user
      - system:certificates.k8s.io:certificatesigningrequests:nodeclient
      - system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
      - system:certificates.k8s.io:kube-apiserver-client-approver
      - system:certificates.k8s.io:kube-apiserver-client-kubelet-approver
      - system:certificates.k8s.io:kubelet-serving-approver
      - system:certificates.k8s.io:legacy-unknown-approver
      - system:cloud-controller-manager
      - system:clustermetrics
      - system:controller:attachdetach-controller
      - system:controller:certificate-controller
      - system:controller:cloud-node-controller
      - system:controller:clusterrole-aggregation-controller
      - system:controller:cronjob-controller
      - system:controller:daemon-set-controller
      - system:controller:deployment-controller
      - system:controller:disruption-controller
      - system:controller:endpoint-controller
      - system:controller:endpointslice-controller
      - system:controller:endpointslicemirroring-controller
      - system:controller:ephemeral-volume-controller
      - system:controller:expand-controller
      - system:controller:generic-garbage-collector
      - system:controller:glbc
      - system:controller:horizontal-pod-autoscaler
      - system:controller:job-controller
      - system:controller:legacy-service-account-token-cleaner
      - system:controller:namespace-controller
      - system:controller:node-controller
      - system:controller:persistent-volume-binder
      - system:controller:pod-garbage-collector
      - system:controller:pv-protection-controller
      - system:controller:pvc-protection-controller
      - system:controller:replicaset-controller
      - system:controller:replication-controller
      - system:controller:resourcequota-controller
      - system:controller:root-ca-cert-publisher
      - system:controller:route-controller
      - system:controller:service-account-controller
      - system:controller:service-controller
      - system:controller:statefulset-controller
      - system:controller:ttl-after-finished-controller
      - system:controller:ttl-controller
      - system:controller:validatingadmissionpolicy-status-controller
      - system:discovery
      - system:gcp-controller-manager
      - system:gke-common-webhooks
      - system:gke-controller
      - system:gke-hpa-actor
      - system:gke-hpa-service-reader
      - system:gke-uas-collection-reader
      - system:gke-uas-metrics-reader
      - system:glbc-status
      - system:heapster
      - system:kube-aggregator
      - system:kube-controller-manager
      - system:kube-dns
      - system:kube-dns-autoscaler
      - system:kube-scheduler
      - system:kubelet-api-admin
      - system:kubestore-collector
      - system:maintenance-controller-cluster-role
      - system:managed-certificate-controller
      - system:master-monitoring-role
      - system:metrics-server
      - system:metrics-server-nanny
      - system:monitoring
      - system:multinet-endpointslice-controller
      - system:network-controller-manager
      - system:node
      - system:node-bootstrapper
      - system:node-problem-detector
      - system:node-proxier
      - system:persistent-volume-provisioner
      - system:public-info-viewer
      - system:resource-tracker
      - system:service-account-issuer-discovery
      - system:service-steering
      - system:slo-monitor
      - system:volume-scheduler
      - training-operator
      - vace-role
      - view
      - workload-controller-ro
      - workload-controller-rw
      - workload-overseer
  - apiGroup: rbac.authorization.k8s.io
    kind: ClusterRoleBinding
    resources:
      - clusterrolebindings
    verbs:
      - "*"
    systemResources:
      - anet-operator-role-binding
      - antrea-agent
      - antrea-controller
      - antrea-cpha
      - argocd-application-controller
      - argocd-notifications-controller
      - argocd-server
      - assets-sync
      - ca-cr
      - ca-pr-beta
      - cert-manager-cainjector
      - cert-manager-controller-approve:cert-manager-io
      - cert-manager-controller-certificates
      - cert-manager-controller-certificatesigningrequests
      - cert-manager-controller-challenges
      - cert-manager-controller-clusterissuers
      - cert-manager-controller-ingress-shim
      - cert-manager-controller-issuers
      - cert-manager-controller-orders
      - cert-manager-webhook:subjectaccessreviews
      - cilium
      - cilium-win
      - cluster-admin
      - cluster-autoscaler
      - cluster-autoscaler-updateinfo
      - cluster-sync
      - dgxc-admission-controller
      - dgxc-customer-app-admin
      # - dgxc-customer-app-admin-access 
      - dgxc-exporter
      - dgxc-runai-controller
      - event-exporter-rb
      - filestorecsi-controller-cluster-role-binding
      - filestorecsi-controller-provisioner-binding
      - filestorecsi-controller-resizer-binding
      - filestorecsi-node-driver-cluster-role-binding
      - filestorecsi-snapshotter-binding
      - fluentbit-gke-pod-label-reader
      - gce:beta:kubelet-certificate-bootstrap
      - gce:beta:kubelet-certificate-rotation
      - gce:cloud-provider
      - gce:gke-metadata-server-reader
      - gce:podsecuritypolicy:gcsfusecsi-node-sa
      - gke-oidc-envoy-impersonate
      - gke-oidc-operator-binding
      - gke-spiffe-controller-is-a-gke-spiffe-issuer
      - gmp-system:collector
      - gmp-system:operator
      - gpu-operator
      - gpu-operator-node-feature-discovery
      - gpu-operator-node-feature-discovery-gc
      - gpu-operator-upgrade-crd-hook-binding
      - ingress-nginx
      - knative-serving-activator-cluster
      - knative-serving-controller-addressable-resolver
      - knative-serving-controller-admin
      - konnectivity-agent-cpha
      - kratos-fluent-bit-read
      - kube-apiserver-kubelet-api-admin
      - kubelet-bootstrap
      - kubelet-bootstrap-certificate-bootstrap
      - kubelet-bootstrap-node-bootstrapper
      - kubelet-cluster-admin
      - kubelet-user-npd-binding
      - kyverno-cleanup-jobs
      - kyverno:admission-controller
      - kyverno:background-controller
      - kyverno:cleanup-controller
      - kyverno:reports-controller
      - maintenance-controller
      - maintenance-handler
      - master-monitoring-role-binding
      - metrics-exporter
      - metrics-server-nanny:system:auth-delegator
      - metrics-server:system:auth-delegator
      - mpi-operator
      - net-kourier
      - netd
      - node-problem-detector-cpu
      - node-problem-detector-gpu
      - node-scale-adjuster-ro
      - nodepool-controller
      - nodes-are-gke-spiffe-users
      - npd-binding
      - nvidia-device-plugin
      - nvidia-device-plugin-mps-control-daemon
      - nvidia-gpu-feature-discovery
      - nvidia-mig-manager
      - nvidia-operator-validator
      - pdcsi-controller-attacher-binding
      - pdcsi-controller-provisioner-binding
      - pdcsi-controller-resizer-binding
      - pdcsi-snapshotter-binding
      - pod-group-assigner
      - pod-group-controller-ro
      - pod-grouper
      - pods-list-osmo-agent
      - prometheus-kube-state-metrics
      - prometheus-operator
      - prometheus-prometheus
      - queue-controller
      - researcher-service-ro
      - runai-accessrule-controller
      - runai-admission-controller-ro
      - runai-agent
      - runai-binder-cluster-wide
      - runai-cluster-api
      - runai-compute-resource-administrator
      - runai-credentials-administrator
      - runai-data-source-administrator
      - runai-data-volume-administrator
      - runai-department-administrator
      - runai-department-viewer
      - runai-device-plugin
      - runai-editor
      - runai-engine-operator
      - runai-environment-administrator
      - runai-external-workload-integrator
      - runai-inference-workload-controller
      - runai-init-ca
      - runai-job-controller
      - runai-l1-researcher
      - runai-l2-researcher
      - runai-mig-parted
      - runai-ml-engineer
      - runai-operator
      - runai-project-controller
      - runai-project-controller-cluster-pvc
      - runai-project-controller-cluster-secret
      - runai-project-controller-limit-range
      - runai-project-controller-ns-creation
      - runai-project-controller-rolebinding-creation
      - runai-project-controller-servicemonitor-creation
      - runai-prometheus
      - runai-research-manager
      - runai-scheduler-ro
      - runai-shared-objects-controller
      - runai-system-administrator
      - runai-template-administrator
      - runai-viewer
      - runai-workload-exporter
      - secretproviderclasses-rolebinding-gke
      - secrets-store-csi-driver-provider-gke-rolebinding
      - skyhook-operator-manager-rolebinding
      - skyhook-operator-proxy-rolebinding
      - snapshot-controller-role
      - sre-cluster-scoped-access
      - sre-full-access-binding
      - status-updater-ro
      - system:anet-manager-cluster-role-binding
      - system:basic-user
      - system:cloud-controller-manager
      - system:clustermetrics
      - system:controller:attachdetach-controller
      - system:controller:certificate-controller
      - system:controller:clusterrole-aggregation-controller
      - system:controller:cronjob-controller
      - system:controller:daemon-set-controller
      - system:controller:deployment-controller
      - system:controller:disruption-controller
      - system:controller:endpoint-controller
      - system:controller:endpointslice-controller
      - system:controller:endpointslicemirroring-controller
      - system:controller:ephemeral-volume-controller
      - system:controller:expand-controller
      - system:controller:generic-garbage-collector
      - system:controller:horizontal-pod-autoscaler
      - system:controller:job-controller
      - system:controller:legacy-service-account-token-cleaner
      - system:controller:namespace-controller
      - system:controller:node-controller
      - system:controller:persistent-volume-binder
      - system:controller:pod-garbage-collector
      - system:controller:pv-protection-controller
      - system:controller:pvc-protection-controller
      - system:controller:replicaset-controller
      - system:controller:replication-controller
      - system:controller:resourcequota-controller
      - system:controller:root-ca-cert-publisher
      - system:controller:route-controller
      - system:controller:service-account-controller
      - system:controller:service-controller
      - system:controller:statefulset-controller
      - system:controller:ttl-after-finished-controller
      - system:controller:ttl-controller
      - system:controller:validatingadmissionpolicy-status-controller
      - system:discovery
      - system:gcp-controller-manager
      - system:gke-common-webhooks
      - system:gke-controller
      - system:gke-hpa-actor
      - system:gke-hpa-service-reader
      - system:gke-uas-collection-reader
      - system:gke-uas-hpa-controller
      - system:gke-uas-metrics-reader
      - system:glbc-status
      - system:konnectivity-server
      - system:kube-controller-manager
      - system:kube-dns
      - system:kube-dns-autoscaler
      - system:kube-proxy
      - system:kube-scheduler
      - system:kubestore-collector
      - system:managed-certificate-controller
      - system:metrics-server
      - system:metrics-server-nanny
      - system:monitoring
      - system:multinet-endpointslice-controller
      - system:network-controller-manager
      - system:node
      - system:node-proxier
      - system:public-info-viewer
      - system:resource-tracker
      - system:service-account-issuer-discovery
      - system:service-steering
      - system:slo-monitor
      - system:volume-scheduler
      - training-operator
      - uas-hpa-external-metrics-reader
      - vace-rolebinding
      - workload-controller-ro
      - workload-overseer
  - apiGroup: ""
    kind: ComponentStatus
    resources:
      - componentstatuses
    verbs:
      - "*"
    systemResources:
      - scheduler
      - controller-manager
      - etcd-0
      - etcd-1
  - apiGroup: cloud.google.com
    kind: ComputeClass
    resources:
      - computeclasses
      - computeclasses/status
    verbs:
      - "*"
    systemResources: []
  - apiGroup: apiextensions.k8s.io
    kind: CustomResourceDefinition
    resources:
      - customresourcedefinitions
      - customresourcedefinitions/status
    verbs:
      - "*"
    systemResources:
      - accessrules.run.ai
      - admissionreports.kyverno.io
      - alertmanagerconfigs.monitoring.coreos.com
      - alertmanagers.monitoring.coreos.com
      # - allowlistedv2workloads.auto.gke.io GKE has a webhook that denies changes
      # - allowlistedworkloads.auto.gke.io GKE has a webhook that denies changes
      - applications.argoproj.io
      - applicationsets.argoproj.io
      - appprojects.argoproj.io
      # - audits.warden.gke.io GKE has a webhook that denies changes
      - backendconfigs.cloud.google.com
      - backgroundscanreports.kyverno.io
      - bindrequests.scheduling.run.ai
      - capacityrequests.internal.autoscaling.gke.io
      - certificaterequests.cert-manager.io
      - certificates.cert-manager.io
      - certificates.networking.internal.knative.dev
      - challenges.acme.cert-manager.io
      - ciliumendpoints.cilium.io
      - ciliumendpointslices.cilium.io
      - ciliumexternalworkloads.cilium.io
      - ciliumidentities.cilium.io
      - ciliumlocalredirectpolicies.cilium.io
      - ciliumnodes.cilium.io
      - cleanuppolicies.kyverno.io
      - clientconfigs.authentication.gke.io
      - clusteradmissionreports.kyverno.io
      - clusterbackgroundscanreports.kyverno.io
      - clustercleanuppolicies.kyverno.io
      - clusterdomainclaims.networking.internal.knative.dev
      - clusterissuers.cert-manager.io
      - clusternodemonitorings.monitoring.googleapis.com
      - clusterpodmonitorings.monitoring.googleapis.com
      - clusterpolicies.kyverno.io
      - clusterpolicies.nvidia.com
      - clusterpolicyreports.wgpolicyk8s.io
      - clusterrules.monitoring.googleapis.com
      - compositecontrollerdefinitions.extensions.dgxc.nvidia.com
      - computeclasses.cloud.google.com
      - configs.engine.run.ai
      - configurations.serving.knative.dev
      - crontests.test.dgxc.nvidia.com
      - datavolumes.run.ai
      - departments.scheduling.run.ai
      - distributedpolicies.run.ai
      - distributedworkloads.run.ai
      - domainmappings.serving.knative.dev
      - externalworkloads.run.ai
      - frontendconfigs.networking.gke.io
      - gcpresourceallowlists.node.gke.io
      - gitlabresources.gitlab.dgxc.nvidia.com
      - gkenetworkparamsets.networking.gke.io
      - globalrules.monitoring.googleapis.com
      - images.caching.internal.knative.dev
      - inferencepolicies.run.ai
      - inferenceworkloads.run.ai
      - ingresses.networking.internal.knative.dev
      - interactivepolicies.run.ai
      - interactiveworkloads.run.ai
      - issuers.cert-manager.io
      - managedcertificates.networking.gke.io
      - memberships.hub.gke.io
      - metrics.autoscaling.internal.knative.dev
      - mpijobs.kubeflow.org
      - mxjobs.kubeflow.org
      - networkinterfaces.networking.gke.io
      - networkloggings.networking.gke.io
      - networks.networking.gke.io
      - nodefeaturegroups.nfd.k8s-sigs.io
      - nodefeaturerules.nfd.k8s-sigs.io
      - nodefeatures.nfd.k8s-sigs.io
      - nodepools.run.ai
      - nvidiadrivers.nvidia.com
      - operatorconfigs.monitoring.googleapis.com
      - orders.acme.cert-manager.io
      - paddlejobs.kubeflow.org
      - podautoscalers.autoscaling.internal.knative.dev
      - podgroups.scheduling.run.ai
      - podlogs.monitoring.grafana.com
      - podmonitorings.monitoring.googleapis.com
      - podmonitors.monitoring.coreos.com
      - policies.kyverno.io
      - policyexceptions.kyverno.io
      - policyreports.wgpolicyk8s.io
      - probes.monitoring.coreos.com
      - projects.run.ai
      - prometheusagents.monitoring.coreos.com
      - prometheuses.monitoring.coreos.com
      - prometheusrules.monitoring.coreos.com
      - provisioningrequests.autoscaling.x-k8s.io
      - pytorchjobs.kubeflow.org
      - queues.scheduling.run.ai
      - redirectservices.networking.gke.io
      - remotenodes.networking.gke.io
      - revisions.serving.knative.dev
      - routes.serving.knative.dev
      - rules.monitoring.googleapis.com
      - runaiaces.runai.dgxc.nvidia.com
      - runaiconfigs.run.ai
      - runaidgxclogexporters.runai.dgxc.nvidia.com
      - runaidgxcnetworkpolicies.runai.dgxc.nvidia.com
      - runaidgxcstorages.runai.dgxc.nvidia.com
      - runaijobs.run.ai
      - runaiplatforms.runai.dgxc.nvidia.com
      - runairuntimes.runai.dgxc.nvidia.com
      - schedulingshards.engine.run.ai
      - scrapeconfigs.monitoring.coreos.com
      - secretproviderclasses.secrets-store.csi.x-k8s.io
      - secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
      - serverlessservices.networking.internal.knative.dev
      - serviceattachments.networking.gke.io
      - servicefunctionchains.networking.gke.io
      - servicemonitors.monitoring.coreos.com
      - servicenetworkendpointgroups.networking.gke.io
      - services.serving.knative.dev
      - skyhooks.skyhook.nvidia.com
      - sriovnetworknodestates.networking.gke.io
      - sriovoperatorconfigs.networking.gke.io
      - tfjobs.kubeflow.org
      - thanosrulers.monitoring.coreos.com
      - trafficselectors.networking.gke.io
      - trainingpolicies.run.ai
      - trainingworkloads.run.ai
      - trustconfigs.security.cloud.google.com
      - updateinfos.nodemanagement.gke.io
      - updaterequests.kyverno.io
      - volumesnapshotclasses.snapshot.storage.k8s.io
      - volumesnapshotcontents.snapshot.storage.k8s.io
      - volumesnapshots.snapshot.storage.k8s.io
      - workloadallowlists.auto.gke.io
      - workloadcertificateconfigs.security.cloud.google.com
      - xgboostjobs.kubeflow.org
  - apiGroup: networking.k8s.io
    kind: IngressClass
    resources:
      - ingressclasses
    verbs:
      # - create 
      # - delete 
      # - deletecollection 
      - get
      - list
      # - patch 
      # - update 
      - watch
    systemResources:
      - nginx
  - apiGroup: ""
    kind: Namespace
    resources:
      - namespaces
      - namespaces/finalize
      - namespaces/status
    verbs:
      - "*"
    systemResources:
      - anthos-identity-service
      - argocd
      - cert-manager
      - default
      - dgxc-admission-controller
      - dgxc-cluster-validator
      - dgxc-tenant-cluster-policies
      - gke-managed-filestorecsi
      - gke-managed-system
      - gmp-public
      - gmp-system
      - gpu-operator
      - ingress-nginx
      - knative-serving
      - kourier-system
      - kube-node-lease
      - kube-public
      - kube-system
      - kubeflow
      - kyverno
      - lalit
      - monitoring
      - mpi-operator
      - node-problem-detector
      - nvdiag
      - nvsentinel
      - observability
      - osmo
      - prometheus
      - runai
      - skyhook
      - test-ns
  - apiGroup: ""
    kind: PersistentVolume
    resources:
      - persistentvolumes
      - persistentvolumes/status
    verbs:
      # - create 
      # - delete 
      # - deletecollection 
      - get
      - list
      # - patch 
      # - update 
      - watch
    systemResources: []
  - apiGroup: scheduling.k8s.io
    kind: PriorityClass
    resources:
      - priorityclasses
    verbs:
      - "*"
    systemResources:
      - build
      - gmp-critical
      - inference
      - interactive-preemptible
      - runai-critical
      - runai-engine-critical
      - system-cluster-critical
      - system-node-critical
      - train
      - train-critical
      - train-high
  - apiGroup: authorization.k8s.io
    kind: SelfSubjectAccessReview
    resources:
      - selfsubjectaccessreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authentication.k8s.io
    kind: SelfSubjectReview
    resources:
      - selfsubjectreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authorization.k8s.io
    kind: SelfSubjectRulesReview
    resources:
      - selfsubjectrulesreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authorization.k8s.io
    kind: SubjectAccessReview
    resources:
      - subjectaccessreviews
    verbs:
      - "*"
    systemResources: []
  - apiGroup: authentication.k8s.io
    kind: TokenReview
    resources:
      - tokenreviews
    verbs:
      - "*"
    systemResources: []

namespacedKinds:
  - apiGroup: policy
    resources:
      - pods/eviction
    verbs:
      - create
  - apiGroup: ""
    kind: Binding
    resources:
      - bindings
    verbs:
      - "*"
  - apiGroup: ""
    kind: ConfigMap
    resources:
      - configmaps
    verbs:
      - "*"
  - apiGroup: apps
    kind: ControllerRevision
    resources:
      - controllerrevisions
    verbs:
      - "*"
  - apiGroup: batch
    kind: CronJob
    resources:
      - cronjobs
      - cronjobs/status
    verbs:
      - "*"
  - apiGroup: apps
    kind: DaemonSet
    resources:
      - daemonsets
      - daemonsets/status
    verbs:
      - "*"
  - apiGroup: apps
    kind: Deployment
    resources:
      - deployments
      - deployments/scale
      - deployments/status
    verbs:
      - "*"
  - apiGroup: discovery.k8s.io
    kind: EndpointSlice
    resources:
      - endpointslices
    verbs:
      - "*"
  - apiGroup: ""
    kind: Endpoints
    resources:
      - endpoints
    verbs:
      - "*"
  - apiGroup: events.k8s.io
    kind: Event
    resources:
      - events
    verbs:
      - "*"
  - apiGroup: ""
    kind: Event
    resources:
      - events
    verbs:
      - "*"
  - apiGroup: autoscaling
    kind: HorizontalPodAutoscaler
    resources:
      - horizontalpodautoscalers
      - horizontalpodautoscalers/status
    verbs:
      - "*"
  - apiGroup: networking.k8s.io
    kind: Ingress
    resources:
      - ingresses
      - ingresses/status
    verbs:
      - "*"
  - apiGroup: batch
    kind: Job
    resources:
      - jobs
      - jobs/status
    verbs:
      - "*"
  - apiGroup: coordination.k8s.io
    kind: Lease
    resources:
      - leases
    verbs:
      - "*"
  - apiGroup: ""
    kind: LimitRange
    resources:
      - limitranges
    verbs:
      - "*"
  - apiGroup: authorization.k8s.io
    kind: LocalSubjectAccessReview
    resources:
      - localsubjectaccessreviews
    verbs:
      - "*"
  - apiGroup: networking.k8s.io
    kind: NetworkPolicy
    resources:
      - networkpolicies
    verbs:
      - "*"
  - apiGroup: ""
    kind: PersistentVolumeClaim
    resources:
      - persistentvolumeclaims
      - persistentvolumeclaims/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: Pod
    resources:
      - pods
      - pods/attach
      - pods/binding
      - pods/ephemeralcontainers
      - pods/eviction
      - pods/exec
      - pods/log
      - pods/portforward
      - pods/proxy
      - pods/status
    verbs:
      - "*"
  - apiGroup: policy
    kind: PodDisruptionBudget
    resources:
      - poddisruptionbudgets
      - poddisruptionbudgets/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: PodTemplate
    resources:
      - podtemplates
    verbs:
      - "*"
  - apiGroup: apps
    kind: ReplicaSet
    resources:
      - replicasets
      - replicasets/scale
      - replicasets/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ReplicationController
    resources:
      - replicationcontrollers
      - replicationcontrollers/scale
      - replicationcontrollers/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ResourceQuota
    resources:
      - resourcequotas
      - resourcequotas/status
    verbs:
      - "*"
  - apiGroup: rbac.authorization.k8s.io
    kind: Role
    resources:
      - roles
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - bind 
      # - escalate 
  - apiGroup: rbac.authorization.k8s.io
    kind: RoleBinding
    resources:
      - rolebindings
    verbs:
      - "*"
  - apiGroup: ""
    kind: Secret
    resources:
      - secrets
    verbs:
      - "*"
  - apiGroup: ""
    kind: Service
    resources:
      - services
      - services/proxy
      - services/status
    verbs:
      - "*"
  - apiGroup: ""
    kind: ServiceAccount
    resources:
      - serviceaccounts
      - serviceaccounts/token
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
      # - impersonate
  - apiGroup: apps
    kind: StatefulSet
    resources:
      - statefulsets
      - statefulsets/scale
      - statefulsets/status
    verbs:
      - "*"

systemSubjects:
  User:
    - cluster-autoscaler
    - kube-apiserver
    - kubelet
    - kubelet-bootstrap
    - kyverno@test.com
    - ladithyav@nvidia.com
    - pwittrock@nvidia.com
    - system:anet-controller-manager
    - system:anet-operator
    - system:cloud-controller-manager
    - system:cluster-autoscaler
    - system:clustermetrics
    - system:controller:glbc
    - system:filestorecsi-controller
    - system:gcp-controller-manager
    - system:gke-common-webhooks
    - system:gke-spiffe-controller
    - system:konnectivity-server
    - system:kube-controller-manager
    - system:kube-proxy
    - system:kube-scheduler
    - system:kubestore-collector
    - system:l7-lb-controller
    - system:maintenance-controller
    - system:managed-certificate-controller
    - system:master-prom-to-sd-monitor
    - system:metrics-server-nanny
    - system:network-controller-manager
    - system:node-problem-detector
    - system:pdcsi-controller
    - system:resource-tracker
    - system:service-steering
    - system:slo-monitor
    - system:snapshot-controller
    - system:vpa-recommender
  Group:
    - access-f-dgx-cloud-runai-non-prod-gcp-admin@nvidia.com
    - access-f-dgx-cloud-runai-non-prod-gcp-engineer@nvidia.com
    - access-f-dgx-cloud-runai-prod-gcp-admin@nvidia.com
    - access-f-dgx-cloud-runai-prod-gcp-engineer@nvidia.com
    - hcuf-f-dgx-cloud-runai-non-prod-gcp-admin@nvidia.com
    - hcuf-f-dgx-cloud-runai-non-prod-gcp-engineer@nvidia.com
    - hcuf-f-dgx-cloud-runai-prod-gcp-admin@nvidia.com
    - hcuf-f-dgx-cloud-runai-prod-gcp-engineer@nvidia.com
    - system:masters
    - system:monitoring
    - system:nodes
    - system:serviceaccounts
    - system:unauthenticated