# Apply with a customer-controlled cluster administrator, never the connector itself.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: snoozedb-eks-connector
rules:
  - apiGroups: [""]
    resources: [nodes]
    verbs: [get, list, watch, patch]
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list, watch]
  - apiGroups: [""]
    resources: [pods/eviction]
    verbs: [create]
  - apiGroups: [apps]
    resources: [deployments, replicasets, daemonsets, statefulsets]
    verbs: [get, list, watch]
  - apiGroups: [apps]
    resources: [deployments/scale]
    verbs: [get, update, patch]
  - apiGroups: [batch]
    resources: [jobs]
    verbs: [get, list, watch]
  - apiGroups: [batch]
    resources: [cronjobs]
    verbs: [get, list, watch, patch]
  - apiGroups: [autoscaling]
    resources: [horizontalpodautoscalers]
    verbs: [get, list, watch]
  - apiGroups: [policy]
    resources: [poddisruptionbudgets]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: snoozedb-eks-connector
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: snoozedb-eks-connector
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: snoozedb:eks-connector