gistfile1.txt

        // This ClusterRole is bound to all humans that log in via prodaccess/prodvider/SSO.
        // It should allow viewing of non-sensitive data for debugability and openness.
        crViewer: kube.ClusterRole("system:viewer") {
            rules: [
                {
                    apiGroups: [""],
                    resources: [
                        "nodes",
                        "namespaces",
                        "pods",
                        "configmaps",
                        "services",
                        "rolebindings",
                    ],
                    verbs: ["list"],
                },
                {
                    apiGroups: ["metrics.k8s.io"],
                    resources: [
                        "nodes",
                        "pods",
                    ],
                    verbs: ["list"],
                },
                {
                    apiGroups: ["apps"],
                    resources: [
                        "statefulsets",
                    ],
                    verbs: ["list"],
                },
                {
                    apiGroups: ["extensions"],
                    resources: [
                        "deployments",
                        "ingresses",
                    ],
                    verbs: ["list"],
                },
                {
                    apiGroups: ["rbac.authorization.k8s.io"],
                    resources: [
                        "clusterroles",
                        "roles",
                        "clusterrolebindings",
                        "rolebindings",
                    ],
                    verbs: ["list", "get"],
                },
            ],
        },