apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: hopsmon-rbac
rules:
  - apiGroups: [""]
    resources: ["nodes/metrics", "nodes", "pods", "pods/proxy", "pods/metrics", "endpoints", "endpoints/proxy", "endpoints/metrics", "services", "services/proxy", "services/proxy", "namespaces", "nodes/proxy"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
# This cluster role binding allows hopsmon user to get, list and watch resources above in any namespace.
kind: ClusterRoleBinding
metadata:
  name: hopsmon-rbac
subjects:
  - kind: Group
    name: hopsworks:monitoring
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: hopsmon-rbac
  apiGroup: rbac.authorization.k8s.io
