kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: calico-policy-controller namespace: {{ system_namespace }} rules: - apiGroups: - "" - extensions resources: - pods - namespaces - networkpolicies verbs: - watch - list