apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: sandbox-observer
  namespace: poimen-sandbox
rules:
  - apiGroups: [""]
    resources: [pods, pods/log, services]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: poimen-devs-sandbox
  namespace: poimen-sandbox
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: "oidc:poimen-devs"
roleRef:
  kind: Role
  name: sandbox-observer
  apiGroup: rbac.authorization.k8s.io