pub const BINDY_NAMESPACED_CLUSTER_ROLE_YAML: &str = "# Copyright (c) 2025 Erick Bourgeois, firestoned\n# SPDX-License-Identifier: MIT\n#\n# DO NOT EDIT BY HAND \u{2014} derived from deploy/operator/rbac/role.yaml.\n# If you change role.yaml, re-split it (see README.md in this directory).\n#\n# The IRREDUCIBLE cluster-wide grant. ClusterBind9Provider is the only bindy\n# kind with `scope: Cluster`, so it can never be watched per-namespace and a\n# namespace-scoped operator still needs this. Note what is NOT here: no\n# cluster-wide Secret read (audit H3), no cluster-wide Deployment write (C2).\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: bindy-role-cluster\n labels: {app.kubernetes.io/name: bindy, app.kubernetes.io/component: rbac}\nrules:\n- apiGroups: [bindy.firestoned.io]\n resources: [clusterbind9providers]\n verbs: [get, list, watch, update, patch]\n- apiGroups: [bindy.firestoned.io]\n resources: [clusterbind9providers/status]\n verbs: [get, update, patch]\n";Expand description
Namespace-scoped split of BINDY_ROLE_YAML: the irreducible cluster-scoped half.
Used when the operator runs with BINDY_WATCH_NAMESPACES set. Contains only
clusterbind9providers — the one bindy kind with scope: Cluster.