apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mirrored-image
  namespace: mirrored-image
rules:
  - apiGroups: [mirror.quorate.dev]
    resources: [mirroredimages]
    verbs: [get, list, watch]
  - apiGroups: [mirror.quorate.dev]
    resources: [mirroredimages/status]
    verbs: [get, patch, update]
  - apiGroups: [argoproj.io]
    resources: [workflows]
    verbs: [create, get]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mirrored-image
  namespace: mirrored-image
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mirrored-image
subjects:
  - kind: ServiceAccount
    name: mirrored-image
    namespace: mirrored-image
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: workflow-exec
  namespace: mirrored-image
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtaskresults]
    verbs: [create, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: workflow-exec
  namespace: mirrored-image
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: workflow-exec
subjects:
  - {kind: ServiceAccount, name: candidate-exec}
  - {kind: ServiceAccount, name: promote-exec}
  - {kind: ServiceAccount, name: cleanup-exec}