apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: bad-role
rules:
  # ok: legacy-api-clusterrole-excessive-permissions
  - apiGroups:
      - apps
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - ""
    resources:
  # ruleid: legacy-api-clusterrole-excessive-permissions
      - "*"
    verbs:
  # ruleid: legacy-api-clusterrole-excessive-permissions
      - "*"
  # ok: legacy-api-clusterrole-excessive-permissions
  - apiGroups:
      - ""
    resources: ["*"]
    verbs:
      - list
  # ok: legacy-api-clusterrole-excessive-permissions
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  
  - apiGroups: [""]
  # ruleid: legacy-api-clusterrole-excessive-permissions
    resources: ["*"]
  # ruleid: legacy-api-clusterrole-excessive-permissions
    verbs: ["*"]
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
      - customresourcedefinitions/status
    verbs:
      - "*"