# Apply: kubectl apply -f manifests/multus/01-rbac.yaml
# Description: ServiceAccount and cluster-scoped RBAC for the Multus
#   DaemonSet (02-daemonset.yaml). sync-wave 0 — after the CRD, before
#   the DaemonSet that uses this ServiceAccount.
#
# Verbatim from k8snetworkplumbingwg/multus-cni's official
# deployments/multus-daemonset-thick.yml (commit 95a0932350f0060cd23209
# 6876e24672a1de83fa, fetched 2026-08-24 — see 02-daemonset.yaml's header
# for the same pin), including the resource.k8s.io (Dynamic Resource
# Allocation) and events.k8s.io rules upstream grants — left in even
# though k3s v1.32 may not register that API group, since RBAC rules for
# a nonexistent group/resource are inert, not an error, and removing
# them would be inventing a divergence from upstream rather than fixing
# anything.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: multus
  namespace: kube-system
  annotations:
    argocd.argoproj.io/sync-wave: "0"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: multus
  annotations:
    argocd.argoproj.io/sync-wave: "0"
rules:
  - apiGroups: ["k8s.cni.cncf.io"]
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/status
    verbs:
      - get
      - list
      - update
      - watch
  - apiGroups:
      - "resource.k8s.io"
    resources:
      - resourceclaims
      - resourceclaims/status
      - resourceslices
    verbs:
      - get
      - list
  - apiGroups:
      - ""
      - events.k8s.io
    resources:
      - events
    verbs:
      - create
      - patch
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: multus
  annotations:
    argocd.argoproj.io/sync-wave: "0"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: multus
subjects:
  - kind: ServiceAccount
    name: multus
    namespace: kube-system