apiVersion: v1
kind: Namespace
metadata:
  name: prevasio-kspm
  labels:
    name: prevasio-kspm
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prevasio-kspm-scanner-cluster-role
rules:
  - apiGroups:
    - rbac.authorization.k8s.io
    resources:
    - roles
    - rolebindings
    - clusterroles
    - clusterrolebindings
    verbs:
    - list
  - apiGroups:
      - ""
    resources:
      - namespaces
    resourceNames:
      - prevasio-kspm
    verbs:
      - create
      - delete
  - apiGroups:
      - storage.k8s.io
    resources:
      - storageclasses
      - volumeattachments
    verbs:
      - list
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prevasio-kspm-scanner-cluster-role-binding
subjects:
- kind: User
  name: <prevasio assumed role arn>
roleRef:
  kind: ClusterRole
  name: prevasio-kspm-scanner-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prevasio-kspm-job-creator-cluster-role
rules:
  - apiGroups:
      - batch
    resources:
      - jobs
    verbs:
      - create
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: prevasio-kspm-job-creator-cluster-role-binding
  namespace: prevasio-kspm
subjects:
- kind: User
  name: <prevasio assumed role arn>
  namespace: prevasio-kspm
roleRef:
  kind: ClusterRole
  name: prevasio-kspm-job-creator-cluster-role
  apiGroup: rbac.authorization.k8s.io