# Read-only access to the fancy-dns objects in one namespace, for the existing
# `fancy-dns` service account. For a runtime outside the cluster, bind the same
# Role (or a ClusterRole for -kube-namespace="") to the user in its kubeconfig.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: fancy-dns-objects
  namespace: dns
rules:
  - apiGroups: [fancydns.k6n.net]
    resources: [dnszones, clientgroups, blocklists, addressoverrides, domainrules]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: fancy-dns-objects
  namespace: dns
subjects:
  - kind: ServiceAccount
    name: fancy-dns
    namespace: dns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: fancy-dns-objects