apiVersion: v1
kind: ServiceAccount
metadata:
  name: restore-drill
  namespace: velero
  labels:
    app.kubernetes.io/part-of: velero-restore-drill
---
# Ops permissions: create/list/get/delete velero Backups+Restores, create+delete
# restore-test-* namespaces. Namespace verbs cannot be name-scoped in RBAC, so we
# accept cluster-wide namespace create/delete. Drill script enforces the
# 'restore-test-' name prefix before deleting.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: velero-restore-drill-ops
  labels:
    app.kubernetes.io/part-of: velero-restore-drill
rules:
  - apiGroups: ["velero.io"]
    resources: ["backups", "restores"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: velero-restore-drill-ops
  labels:
    app.kubernetes.io/part-of: velero-restore-drill
subjects:
  - kind: ServiceAccount
    name: restore-drill
    namespace: velero
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: velero-restore-drill-ops
---
# Read-only diff permissions: cluster-scoped read of the workload resources we
# compare between the source and restored namespaces.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: velero-restore-drill-view
  labels:
    app.kubernetes.io/part-of: velero-restore-drill
subjects:
  - kind: ServiceAccount
    name: restore-drill
    namespace: velero
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view