module RbacRules

Builds Kubernetes RBAC PolicyRule arrays from a shorthand hash of resource-spec => verbs. The spec is "resource" (core API group), "resource/subresource" (core), "group/resource", or "group/resource/subresource":

RbacRules.build( "secrets" => %w[get list], "pods/log" => %w[get], "batch/cronjobs" => %w[get], "argoproj.io/workflows" => %w[get list], "subresources.kubevirt.io/virtualmachines/restart" => %w[create], )

The first path segment is an API group when the schema knows it as one (Kube::Schema.api_groups -- "batch", "apps", "argoproj.io", ...) or when it contains a dot: API groups are DNS subdomains, so a dotted segment is a group even when no schema has registered it (e.g. a CRD group local to one cluster). Anything else is a core resource, subresource included.