---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: n8n-clusterrole
rules:
  # Core API group ("")
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  # Common built-in API groups
  - apiGroups: ["apps", "batch", "autoscaling", "extensions", "policy"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["networking.k8s.io", "rbac.authorization.k8s.io", "apiextensions.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["coordination.k8s.io", "discovery.k8s.io", "events.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["storage.k8s.io", "admissionregistration.k8s.io", "authentication.k8s.io", "authorization.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: n8n-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-clusterrole
subjects:
- kind: ServiceAccount
  name: n8n
  namespace: n8n