apiVersion: v1
kind: Namespace
metadata:
  name: qa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: chip
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: chip-qa-rolebinding
  namespace: qa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: chip
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: chip
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: chip-special-role
  namespace: qa
rules:
- apiGroups:
  - ""
  resources:
    - pods
  verbs:
    - get
    - create
    - list
    - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: chip-qa-specialrb
  namespace: qa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: chip-special-role
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: chip
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: record-creation-details
spec:
  background: false
  rules:
  - name: add-userinfo
    match:
      any:
      - resources:
          kinds:
          - ConfigMap
    preconditions:
      any:
      - key: "{{request.operation || 'BACKGROUND'}}"
        operator: Equals
        value: CREATE
    mutate:
      patchStrategicMerge:
        metadata:
          annotations:
            kyverno.io/created-by: "{{ request.userInfo | to_string(@) }}"
            kyverno.io/roles: "{{ request.roles | sort(@) | to_string(@) }}"
            kyverno.io/clusterroles: "{{ request.clusterRoles | sort(@) | to_string(@) }}"