---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gateway-api-role-distributor
rules:
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - rolebindings
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterroles
    resourceNames:
      - gateway-api-role-distributor
    verbs:
      - get
      - bind
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:controller:gateway-api-role-distributor
  labels:
    projectcapsule.dev/aggregate-to-controller: "true"
rules:
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterroles
    resourceNames:
      - gateway-api-role-distributor
    verbs:
      - get
      - bind
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oidc:admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: User
    name: admin
