# Just enough permissions to submit a workflow template.
# You could tighten this further (but perhaps impractically) by using `resourceNames`
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: # kpt-merge: /submit-workflow-template
  name: submit-workflow-template
  annotations:
    internal.kpt.dev/upstream-identifier: 'rbac.authorization.k8s.io|Role|default|submit-workflow-template'
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workfloweventbindings
    verbs:
      - list
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtemplates
    verbs:
      - get
  - apiGroups:
      - argoproj.io
    resources:
      - workflows
    verbs:
      - create
