# IMPORTANT: kubectl apply -f rbac-setup.yaml --as=admin --as-group=system:masters
apiVersion: v1
kind: Namespace
metadata:
  name: stackdriver-agents
---
apiVersion: v1
data:
  credentials_path: ""
kind: ConfigMap
metadata:
  name: google-cloud-config
  namespace: stackdriver-agents
---
apiVersion: v1
data:
  cluster_name: ""
  cluster_location: ""
kind: ConfigMap
metadata:
  name: cluster-config
  namespace: stackdriver-agents
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metadata-agent
  namespace: stackdriver-agents
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: stackdriver-user:metadata-agent
  namespace: stackdriver-agents
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - watch
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: stackdriver-user:metadata-agent
  namespace: stackdriver-agents
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: stackdriver-user:metadata-agent
subjects:
- kind: ServiceAccount
  name: metadata-agent
  namespace: stackdriver-agents
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: heapster
  namespace: stackdriver-agents
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: stackdriver-user:heapster
  namespace: stackdriver-agents
rules:
- apiGroups:
  - ""
  resources:
  - events
  - namespaces
  - nodes
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - deployments
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: stackdriver-user:heapster
  namespace: stackdriver-agents
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: stackdriver-user:heapster
subjects:
- kind: ServiceAccount
  name: heapster
  namespace: stackdriver-agents
